CVE-2026-72489

CVE-2026-72489 is a use-after-free in the nvec (NVIDIA Embedded Controller) staging driver where the vulnerability is fundamentally different from textbook dangling-pointer UAFs—and more dangerous because of it. The bug: the code reads nvec->rx->data[0] (the message type byte) after calling nvec_msg_free() to release the message slot. Because the allocator uses atomic operations, the freed slot becomes immediately reclaimable. A concurrent allocation can win the race between the free and the read, meaning the value the kernel reads is whatever the attacker wrote into that slot—not stale original data. This changes the exploitation calculus. In a classic UAF, you're reading whatever happened to be in freed memory. Here, you control what appears in data[0] if you can win the race to allocate that slot. The battery quirk check that consumes this byte becomes the exploitation target: if an attacker can reliably corrupt the message type value, they influence how the kernel responds to battery conditions. Whether that rises to safety-critical depends on what the quirk dispatch logic actually does—but the existence of any quirk-driven code path for battery behavior means this staging driver has a real bridge to physical system state. The fix is trivial—a single-line reordering to read the byte before freeing—but the pattern reveals a deeper issue. Staging drivers receive less scrutiny than mainline subsystems while running with full kernel privileges. The 'save-before-free' pattern has decades of institutional CVE history behind it, yet it persists in code paths that developers treat as 'less consequential.' The battery subsystem didn't consciously choose to trust nvec's message type byte; it evolved alongside the driver and accumulated that trust silently. Defenders should audit other staging drivers for the same pattern, particularly those handling hardware state that could graft onto safety-adjacent subsystems. The battery quirk dispatch logic warrants closer inspection to determine whether a corrupted message type byte can trigger unsafe behavior—or whether the subsystem design implicitly assumed non-adversarial message injection.

Reviewed through automated stages and approved by a human before publication.