CVE-2026-72146

This CVE reveals an initialization-order vulnerability in the Renesas RZ-DMAC driver where the IRQ handler was registered before the channel structures it depends on were populated, creating a deterministic race window. The handler accesses ch_base as NULL when fired during the window between IRQ registration and structure initialization. This isn't merely an ordering bug — the fix also replaces dma_alloc_coherent() with dmam_alloc_coherent(), indicating the driver was using the wrong allocation API for this hardware context. The dmam_* variant provides managed memory that simplifies error-path teardown, and the commit message explicitly notes this was done 'to keep the error path simpler' — meaning the original developer treated resource cleanup as an afterthought rather than a symmetric design concern. The CVSS 8.4 reflects real exploitability, but the EPSS score of 0.0018 understates the actual risk for embedded deployments. The systems running this driver — industrial controllers, medical devices, factory automation hardware based on RZ platforms — have firmware update cycles measured in quarters or years, not days. The vulnerability lives in production much longer than it would on rolling-release systems. More critically, the bug's manifestation depends on device tree configuration, memory pressure at boot, and which peripheral is mid-transaction when the handler fires with uninitialized state — meaning the blast radius varies dramatically across deployments. Silent memory corruption spreading to adjacent subsystems is the realistic failure mode, not a clean crash. The deeper question this CVE should force: the RZ-DMAC driver shares code ancestry with sh-mobile and older R-Car DMA drivers. When the kernel migrated to dmam_alloc_coherent() as the preferred API, this driver was missed — orphaned code that kept compiling without triggering observable failures. The same API migration period likely produced other drivers still using deprecated patterns in paths not yet exercised. Audit sibling DMA drivers in the sh-architecture lineage for identical initialization-order inversions and non-migrated allocation API usage.

Reviewed through automated stages and approved by a human before publication.