CVE-2026-72133 spi: uniphier: Fix completion initialization order before devm_request_irq()
A race condition in the Linux kernel SPI driver allows an interrupt to trigger before completion initialization, potentially causing undefined behavior and system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72133?
CVE-2026-72133 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
spi: uniphier: Fix completion initialization order before devm_request_irq()
The driver calls devm_request_irq() before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after devm_request_irq(), the handler may execute before init_completion().
This may result in calling complete() on an uninitialized completion, causing undefined behavior. This has been observed with KASAN.
Fix this by initializing the completion before registering the IRQ.
Which versions are affected by CVE-2026-72133?
How do I fix CVE-2026-72133?
Apply the vendor's patch.
Is CVE-2026-72133 being exploited?
There is no known exploitation of CVE-2026-72133 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72133, DEBIAN-CVE-2026-72133, GHSA-24h9-gmhv-mhpq, UBUNTU-CVE-2026-72133.