CVE-2026-72109net: sparx5: unregister blocking notifier on init failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5_register_notifier_blocks() registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregisters the switchdev and netdevice notifiers, but leaves the blocking notifier registered. Add a separate error label for the workqueue allocation failure path and unregister the switchdev blocking notifier there.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d6fce5141929697a27f029c633433d487f6f62cb before fbc65b17508ed5464b7106e7fa5f15251ca1b603; from d6fce5141929697a27f029c633433d487f6f62cb before e5afc6d3fabdf1f605d63c4b34a3df6c359e81f3; from d6fce5141929697a27f029c633433d487f6f62cb before cf419c869e0d03aad4b6f4ecf0a813851930dfe7; from d6fce5141929697a27f029c633433d487f6f62cb before d6084c47389fd6978a5d66b0d58206a548c792a9; from d6fce5141929697a27f029c633433d487f6f62cb before 8a3c44a003176282ee4306b7c96e5a536c6f0707; from d6fce5141929697a27f029c633433d487f6f62cb before 17f113e7b622dc850992ade540181717de6a8561; from d6fce5141929697a27f029c633433d487f6f62cb before 483be61b4a9a6df3b7cb277e8f189e082dee4cb8 | CNA record |
References
- https://git.kernel.org/stable/c/fbc65b17508ed5464b7106e7fa5f15251ca1b603
- https://git.kernel.org/stable/c/e5afc6d3fabdf1f605d63c4b34a3df6c359e81f3
- https://git.kernel.org/stable/c/cf419c869e0d03aad4b6f4ecf0a813851930dfe7
- https://git.kernel.org/stable/c/d6084c47389fd6978a5d66b0d58206a548c792a9
- https://git.kernel.org/stable/c/8a3c44a003176282ee4306b7c96e5a536c6f0707
- https://git.kernel.org/stable/c/17f113e7b622dc850992ade540181717de6a8561
- https://git.kernel.org/stable/c/483be61b4a9a6df3b7cb277e8f189e082dee4cb8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.