{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-72047",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-72047"
  ],
  "published": "2026-08-15T06:04:33Z",
  "summary": "ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: ca8210: fix pointer truncation in kfifo on 64-bit\n\nca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange\na kmalloc'd buffer pointer through a struct kfifo, but pass a literal\n'4' as the byte count to kfifo_in()/kfifo_out().\n\nThis is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the\nlow 4 bytes of the 8-byte pointer are written into the FIFO. The reader\nthen reads back 4 bytes into an 8-byte local pointer variable, leaving\nthe upper 4 bytes uninitialized stack data. The first dereference of\nthe reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel\naddress and generally results in an oops.\n\nUse sizeof(fifo_buffer) so the byte count matches pointer width on every\narchitecture.\n\nThe driver has no architecture restriction in Kconfig, so any 64-bit\nbuild with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has\nbeen latent since the driver was added in 2017 because it is most\ncommonly deployed on 32-bit MCUs.\n\nFound via a custom Coccinelle semantic patch hunting for short-byte\nkfifo I/O on byte-mode kfifos used to shuttle pointers.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.178",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72047"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2c1664ccfae653979b38788211240b5a1ee317ed"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/093aacb0c56d5c693e3169a0224062e77c3fd0c0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/87dab14a4f68895d6f4d798e6ee3556cd64e8c72"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1fe2643d0b24ca3cdd61a31a45c2d3233dc6cbfe"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/65dc342274a01616f5c17105f7360a3b4bfd7a3d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2059c28bd725beded01277cdf1f67be33e714323"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d8ce67fa6a5e6929f5414e933ff9665176c2bce6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6d7f7bcf225b2d566176bf6229dbd1252940cb3c"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:24:08Z"
  }
}