CVE-2026-72314 (GCVE-0-2026-72314)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-08-17 05:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
Compare against -EDEADLK, which is what ww_mutex_lock() actually
returns and what every other deadlock check in this file already uses.
Function regulator_lock_two() acquires two regulators via
regulator_lock_nested() -> ww_mutex_lock(). On contention,
ww_mutex_lock() returns -EDEADLK, which is the caller's signal to drop
the lock it holds and retry the acquisition in the canonical order.
However, regulator_lock_two() tests the return value against -EDEADLOCK
rather than -EDEADLK. On most architectures, EDEADLK and EDEADLOCK are
the same value, so the comparison happens to be correct and the bug is
invisible. But on MIPS, SPARC, and PowerPC, those two errors have
different values. The test is wrong: a genuine -EDEADLK backoff no
longer matches -EDEADLOCK, so instead of unlocking and retrying, the
code falls into WARN_ON(ret) and returns with only one of the two
regulators locked.
In practice, this is a bug only on MIPS, because the regulator core is
not built or used on the other two platforms.
In general, EDEADLK is preferred over EDEADLOCK for new code.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 06140d6dfe720d80566f792b4e28a9cd60a67970 Version: 1e3056b8067c2e9b7741c4e588f0acacbe4bdafc Version: 849ab4cf182b38e562ffcc1b494d510e948822dd Version: cba6cfdc7c3f1516f0d08ddfb24e689af0932573 Version: cba6cfdc7c3f1516f0d08ddfb24e689af0932573 Version: cba6cfdc7c3f1516f0d08ddfb24e689af0932573 Version: cba6cfdc7c3f1516f0d08ddfb24e689af0932573 Version: cba6cfdc7c3f1516f0d08ddfb24e689af0932573 Version: 5224ea575196db11c0a909a78ea426ccdb92f064 Version: 435c65af581a61ca249bd8f717c3a147dc119f11 Version: cdc042430ea9e07f77ce05a9d29e227dbdecc733 Version: 5.10.180 ≤ Version: 5.15.111 ≤ Version: 6.1.28 ≤ Version: 5.4.243 ≤ Version: 6.2.15 ≤ Version: 6.3.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/regulator/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dc804f390fddd9c389edf0976356942e16878d8f",
"status": "affected",
"version": "06140d6dfe720d80566f792b4e28a9cd60a67970",
"versionType": "git"
},
{
"lessThan": "8e39aa63798ea0a797fd9341419f12ef91df3238",
"status": "affected",
"version": "1e3056b8067c2e9b7741c4e588f0acacbe4bdafc",
"versionType": "git"
},
{
"lessThan": "0c305eac40470a224671858a215963b070f9b2a9",
"status": "affected",
"version": "849ab4cf182b38e562ffcc1b494d510e948822dd",
"versionType": "git"
},
{
"lessThan": "29a7953e9adea6c7f9e64947745b79158e7cea7f",
"status": "affected",
"version": "cba6cfdc7c3f1516f0d08ddfb24e689af0932573",
"versionType": "git"
},
{
"lessThan": "e2063307ea3b6da74585129ba7b588e8243e2ef0",
"status": "affected",
"version": "cba6cfdc7c3f1516f0d08ddfb24e689af0932573",
"versionType": "git"
},
{
"lessThan": "346e2d666a29ae7233c56b356a0487eb1d42589b",
"status": "affected",
"version": "cba6cfdc7c3f1516f0d08ddfb24e689af0932573",
"versionType": "git"
},
{
"lessThan": "153d1b8b5bc30847eb70ad535f62f289aa9217e6",
"status": "affected",
"version": "cba6cfdc7c3f1516f0d08ddfb24e689af0932573",
"versionType": "git"
},
{
"lessThan": "d38f8bd771c4999b797d7074b348cf201414bd34",
"status": "affected",
"version": "cba6cfdc7c3f1516f0d08ddfb24e689af0932573",
"versionType": "git"
},
{
"status": "affected",
"version": "5224ea575196db11c0a909a78ea426ccdb92f064",
"versionType": "git"
},
{
"status": "affected",
"version": "435c65af581a61ca249bd8f717c3a147dc119f11",
"versionType": "git"
},
{
"status": "affected",
"version": "cdc042430ea9e07f77ce05a9d29e227dbdecc733",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.243",
"versionType": "semver"
},
{
"lessThan": "6.3",
"status": "affected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/regulator/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.243",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK\n\nCompare against -EDEADLK, which is what ww_mutex_lock() actually\nreturns and what every other deadlock check in this file already uses.\n\nFunction regulator_lock_two() acquires two regulators via\nregulator_lock_nested() -\u003e ww_mutex_lock(). On contention,\nww_mutex_lock() returns -EDEADLK, which is the caller\u0027s signal to drop\nthe lock it holds and retry the acquisition in the canonical order.\n\nHowever, regulator_lock_two() tests the return value against -EDEADLOCK\nrather than -EDEADLK. On most architectures, EDEADLK and EDEADLOCK are\nthe same value, so the comparison happens to be correct and the bug is\ninvisible. But on MIPS, SPARC, and PowerPC, those two errors have\ndifferent values. The test is wrong: a genuine -EDEADLK backoff no\nlonger matches -EDEADLOCK, so instead of unlocking and retrying, the\ncode falls into WARN_ON(ret) and returns with only one of the two\nregulators locked.\n\nIn practice, this is a bug only on MIPS, because the regulator core is\nnot built or used on the other two platforms.\n\nIn general, EDEADLK is preferred over EDEADLOCK for new code."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in drivers/regulator/core.c and is reached only through local kernel paths (regulator_register(), regulator_get()/devm_regulator_get(), and regulator_bus_probe()) during driver probing and supply resolution, not via any network protocol or remote packet handler.\nAC:L - Triggering -EDEADLK requires concurrent regulator_resolve_supply() on interdependent regulators; an attacker who can influence driver probing (e.g., parallel module loads or concurrent async platform probe work) controls both sides of the ww_mutex contention and can reliably force the mis-handled backoff path on MIPS.\nPR:L - Deliberate exploitation needs only basic local access on MIPS embedded/IoT systems where concurrent async regulator supply resolution during driver probe is common; hardened systems may require module-load privileges, but user namespaces do not gate this subsystem and misconfigured deployments widen reach.\nUI:N - No victim interaction is required once the attacker can trigger concurrent regulator supply resolution; exploitation is driven entirely by attacker-controlled driver probing/concurrency rather than requiring a user to mount, open, or configure anything.\nS:U - Impact is confined to kernel memory/locking integrity and local privilege boundaries (improperly locked regulator_dev state); it does not cross VM, container, or IOMMU security boundaries into a separate authority.\nC:H - Failing to acquire both regulator mutexes before set_supply()/create_regulator() permits unsynchronized list_add() to consumer_list and open_count updates, creating exploitable races that can yield kernel memory disclosure primitives alongside corruption.\nI:H - Operating on regulator_dev supply pointers, consumer_list, and open_count without holding both ww_mutex locks enables heap/list corruption and use-after-free style races that are reasonably leveragable for arbitrary kernel write or control-flow hijack on MIPS.\nA:H - The broken EDEADLK handling leaves regulators in an inconsistent partially-locked state, emitting WARN_ON and risking kernel deadlocks, hangs, or oops during concurrent supply resolution on MIPS systems where EDEADLK and EDEADLOCK differ."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:40.833Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dc804f390fddd9c389edf0976356942e16878d8f"
},
{
"url": "https://git.kernel.org/stable/c/8e39aa63798ea0a797fd9341419f12ef91df3238"
},
{
"url": "https://git.kernel.org/stable/c/0c305eac40470a224671858a215963b070f9b2a9"
},
{
"url": "https://git.kernel.org/stable/c/29a7953e9adea6c7f9e64947745b79158e7cea7f"
},
{
"url": "https://git.kernel.org/stable/c/e2063307ea3b6da74585129ba7b588e8243e2ef0"
},
{
"url": "https://git.kernel.org/stable/c/346e2d666a29ae7233c56b356a0487eb1d42589b"
},
{
"url": "https://git.kernel.org/stable/c/153d1b8b5bc30847eb70ad535f62f289aa9217e6"
},
{
"url": "https://git.kernel.org/stable/c/d38f8bd771c4999b797d7074b348cf201414bd34"
}
],
"title": "regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72314",
"datePublished": "2026-08-15T05:55:29.118Z",
"dateReserved": "2026-08-09T03:40:39.918Z",
"dateUpdated": "2026-08-17T05:42:40.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…