Strix
56.3K

CVE-2026-72424

UnknownEPSS 0.18%

Last modified

CVE-2026-72424 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and &pdev->dev as the cookie, but platform_set_drvdata() is only called later after the clock setup. With a shared IRQ line, another device on the same line can trigger the handler in that window. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and &pdev->dev as the cookie, but platform_set_drvdata() is only called later after the clock setup. With a shared IRQ line, another device on the same line can trigger the handler in that window. The handler does dev_get_drvdata() on the cookie, gets NULL, and dereferences priv->rtc_base in interrupt context. Pass priv as the cookie directly so the handler reads it from dev_id without the lookup, removing the dependency on probe order.

Metrics

EPSS Probability
0.18%

7.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= be7d9c9161b9c76edeff15e79edc2f256568fe05, < ece7b9ffde23e2ccd7567761ac27463ded43932c; >= be7d9c9161b9c76edeff15e79edc2f256568fe05, < 52c73b6992b46ed476590ed526faa033d4fbfc5d; >= be7d9c9161b9c76edeff15e79edc2f256568fe05, < bc1f61a9b97d65de21c2681bcf0b5b1392c58486; >= be7d9c9161b9c76edeff15e79edc2f256568fe05, < 1f6a4aec0d36647eb2f67cd69db22bd28cabe2cb; >= be7d9c9161b9c76edeff15e79edc2f256568fe05, < bb3e624808c981fe881cb79037be63e680ed7d38; >= be7d9c9161b9c76edeff15e79edc2f256568fe05, < a369f48be8de426a7d2bca18dbd46c2ad1138803
LinuxLinux5.16

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72424?
In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and &pdev->dev as the cookie, but platform_set_drvdata() is only called later after the clock setup. With a shared IRQ line, another device on the same line can trigger the handler in that window. The handler does dev_get_drvdata() on the cookie, gets NULL, and dereferences priv->rtc_base in interrupt context. Pass priv as the cookie directly so the handler reads it from dev_id without the lookup, removing the dependency on probe order.
How severe is CVE-2026-72424?
Severity scoring for CVE-2026-72424 is pending analysis. The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72424?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72424?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST