Executive brief
The Linux kernel's regmap cache initialization function has a bug where an error from the cache population step is overwritten by a subsequent cleanup step, hiding the original error condition from callers. This can cause the system to attempt to use an improperly initialized cache, leading to null pointer crashes and system instability when register access is attempted later.
Technical details
The vulnerability is a logic error in the regcache initialization path (regcache.c, regcache_init() function). When cache_ops->populate() fails during initialization and the cache operations define an exit callback, the error code from populate() is overwritten when the exit callback is invoked. The fix is a one-line change: removing the assignment of the exit() return value to the ret variable, preventing it from overwriting the original error code. Attack vector is local (requires ability to trigger regcache initialization with specific cache operation combinations). The vulnerability can cause NULL pointer dereferences when callers attempt to use the regcache without detecting the initialization failure.
Affected products
- Linux Linux Kernel multiple versions (patch applies across 2.6.11 through 7.2 stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-06-16: patched: Upstream fix committed by Mark Brown