CVE-2026-100072
HIGH 7.8In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpi_bus_get_primary_device() The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in theory the device returned by it may be freed at any time [1]. It is also inefficient because acpi_get_first_physical_node() is called multiple times for the same argument which can be avoided. Address these issues by using acpi_bus_get_primary_device() instead of acpi_get_first_physical_node() and adjusting the code to call it just once at the beginning of and acpi_create_platform_device() and drop the device reference acquired by it upon the return from that function.
Severe if exploited (CVSS 7.8), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 5th percentile
Impact if exploited
7.8CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-416: Use after free
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 278 vendor product statements; 246 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-abi-stablelists as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-abi-stablelists
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-modules-extra-matched as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules-extra-matched
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-core
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-uki-virt as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-uki-virt
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
bpftool as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/bpftool
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-doc
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-abi-whitelists as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-abi-whitelists
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt.src as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt?arch=src
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-64k as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-64k-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-modules-extra
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-debug-uki-virt-addons as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-uki-virt-addons
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-64k-modules-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-modules-internal
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-rt-kvm as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-kvm
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
kernel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-abi-whitelists as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-abi-whitelists
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-bootwrapper as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-bootwrapper
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-debug as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-debug-devel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-devel
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-devel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-devel
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-firmware as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-firmware
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-headers as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-headers
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-kdump as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-kdump
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel-kdump-devel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-kdump-devel
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00kernel.src as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/perf
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00python-perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python-perf
Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Linux | Linux Kernel | ≥ 4.6 and < 7.2.6 |
References
Patches & mitigations
- https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503 CVE record · Linux · Updated 2026-10-21T12:38:45.183Z
NVD · CVE-2026-100072 · Updated 2026-10-21T18:49:49.167 - https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c CVE record · Linux · Updated 2026-10-21T12:38:45.183Z
NVD · CVE-2026-100072 · Updated 2026-10-21T18:49:49.167 - https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71 CVE record · Linux · Updated 2026-10-21T12:38:45.183Z
NVD · CVE-2026-100072 · Updated 2026-10-21T18:49:49.167 - https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd CVE record · Linux · Updated 2026-10-21T12:38:45.183Z
NVD · CVE-2026-100072 · Updated 2026-10-21T18:49:49.167
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100072.json Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87069 EUVD · EUVD-2026-87069
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-100072 Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2541429 Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-100072 Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-100072 Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00
- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-100072.mbox Red Hat · CVE-2026-100072 · Updated 2026-10-22T04:07:54+00:00