Executive brief
The Linux kernel's CA8210 IEEE 802.15.4 wireless device driver contains a pointer handling bug that only manifests on 64-bit architectures when debug filesystem support is enabled. When reading or writing pointers through a kernel FIFO queue, the driver incorrectly truncates 8-byte pointers to 4 bytes, leaving uninitialized stack data that causes the kernel to crash when dereferenced. This affects all 64-bit systems running this driver with debugging features enabled.
Technical details
The vulnerability is a pointer truncation bug in the ca8210 IEEE 802.15.4 driver's debug test interface functions (ca8210_test_int_driver_write and ca8210_test_int_user_read). These functions exchange kmalloc'd buffer pointers through a kfifo queue using a hardcoded literal '4' for the byte count instead of using sizeof() to match the pointer width. On 32-bit systems this is harmless (pointers are 4 bytes), but on 64-bit systems only the low 4 bytes of the 8-byte pointer are written to the FIFO and read back, leaving the upper 4 bytes as uninitialized stack data. Dereferencing the reconstructed invalid pointer results in a kernel oops. The bug requires CONFIG_IEEE802154_CA8210_DEBUGFS=y to be enabled and only affects 64-bit kernel builds. The fix changes the hardcoded byte count to sizeof(fifo_buffer) so it matches pointer width on all architectures.
Affected products
- Linux Linux kernel since 2017 (driver introduction in commit ded845a781a5); affected across multiple kernel versions from 2.6.11 through 6.9+
Timeline
- 2026-05-20: disclosed: Patch submitted by Shitalkumar Gandhi
- 2026-07-24: patched: Backported to stable kernel trees
- 2026-08-15: advisory: CVE-2026-72047 published