{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-72486 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-72486 is an use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-72486 and fix it if it is affected.\n\nWhat it is: CVE-2026-72486 is an use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-72486 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-72486/ (Markdown: https://insights.sbomify.com/CVE-2026-72486/index.md)","id":"CVE-2026-72486","markdown":"https://insights.sbomify.com/CVE-2026-72486/index.md","name":"CVE-2026-72486","record":{"aliases":["BELL-CVE-2026-72486","DEBIAN-CVE-2026-72486","GHSA-7xg7-8g6q-847f","UBUNTU-CVE-2026-72486"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A use-after-free in the Linux kernel mtk-adsp mailbox driver allows local attackers to cause a system crash or potentially execute code during device teardown.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-adsp: fix UAF during device teardown\n\nWhen the SOF audio driver fails to initialize (e.g. firmware boot\ntimeout), its devres unwind frees the snd_sof_dev object that the\nmailbox client (mtk-adsp-ipc) reaches via chan-\u003ecl-\u003erx_callback.\nThe mtk-adsp-mailbox shutdown clears the mailbox command registers\nbut leaves the IRQ line unmasked, so a late interrupt can still\nqueue a threaded handler after mbox_free_channel() had cleared\nchan-\u003ecl, and mbox_chan_received_data() would then trigger UAF:\n\n  BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version\n   sof_ipc3_validate_fw_version\n   sof_ipc3_do_rx_work\n   sof_ipc3_rx_msg\n   mt8196_dsp_handle_request\n   mtk_adsp_ipc_recv\n   mbox_chan_received_data\n   mtk_adsp_mbox_isr\n   irq_thread_fn\n  Freed by task ...:\n   kfree\n   devres_release_all\n   really_probe\n   ... (sof-audio-of-mt8196 probe failure)\n\nThe crash was observed roughly three seconds after the failed probe.\n\ndisable_irq() in shutdown and enable_irq() in startup. disable_irq()\nalso waits for any in-flight interrupts, so by the time\nmbox_free_channel() proceeds to clear chan-\u003ecl no rx_callback can run.\n\nIn addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked\nbetween probe and the first client bind — otherwise an early interrupt\ncan crash on chan-\u003ecl == NULL in mbox_chan_received_data().","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mailbox: mtk-adsp: fix UAF during device teardown","id":"CVE-2026-72486","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"PCI: Check ROM header and data structure addr before accessing","id":"CVE-2026-72487"},"packages":[],"prev":{"headline":"coresight: platform: defer connection counter increment until alloc succeeds","id":"CVE-2026-72485"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel mtk-adsp mailbox driver allows local attackers to cause a system crash or potentially execute code during device teardown.","url":"https://insights.sbomify.com/CVE-2026-72486/"}