CVE-2026-72489

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is hit in the I2C slave IRQ handler when the embedded controller ends an RX transfer early; on affected Tegra20 PAZ00 netbooks a local actor can reach it by stressing EC traffic via kernel battery polling and userspace sysfs/input subdrivers (LED, keyboard) that call nvec_write_async().

AC:LAttack complexity, low

This is a use-after-free where nvec_msg_free() returns the RX pool slot and the handler immediately re-reads nvec->rx->data[0]; on SMP an attacker can provoke incomplete NVEC_BAT responses while concurrent I2C IRQs call nvec_msg_alloc(), controlling both sides of the slot-reuse race.

PR:NPrivileges required, none

No elevated privileges are needed because the nvec-power delayed worker automatically issues NVEC_BAT requests every five seconds at boot, and documented incomplete EC battery responses can reach the vulnerable IRQ path before any user authentication or special capabilities.

UI:NUser interaction, none

Exploitation does not require victim interaction; kernel background battery and AC polling plus EC-initiated incomplete transfers can invoke nvec_rx_completed() without the user mounting filesystems, opening files, or performing other deliberate actions.

S:UScope, unchanged

Impact is confined to kernel memory and privileges on the same Tegra SoC running the driver; this is not a VM escape, hypervisor breakout, or other cross-security-authority boundary violation.

C:HConfidentiality impact, high

Reading nvec->rx->data[0] after nvec_msg_free() is a use-after-free on a msg_pool slot where concurrent nvec_msg_alloc() can overwrite data[], yielding attacker-influenced kernel memory reads and potential disclosure of pointers or adjacent structure contents.

I:HIntegrity impact, high

Use-after-free on reusable nvec_msg pool entries can be leveraged for controlled reuse of freed message buffers, enabling heap-style corruption primitives that may lead to arbitrary kernel memory writes and privilege escalation or code execution.

A:HAvailability impact, high

The post-free read can mis-handle ec_transfer completion and corrupt IRQ-time state; use-after-free in hardirq context can kernel oops or panic the system, consistent with the original battery-quirk crash this code path was introduced to mitigate.