CVE-2026-72048

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: fix cas_ctl leak on spi_async failure

ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC)

and relies entirely on the SPI completion callback

ca8210_spi_transfer_complete() to free it.

The spi_async() API only invokes the completion callback on successful

submission. On failure it returns a negative error code without ever

queuing the callback, which leaves cas_ctl and its embedded spi_message

and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is

inside the completion callback, so there is no other reclamation path.

ca8210_spi_transfer() is called from ca8210_spi_exchange(), the

interrupt handler ca8210_interrupt_handler(), and from the retry path

inside the completion callback itself. The exchange and interrupt

handler paths loop on -EBUSY, so under sustained SPI bus contention

every retry iteration leaks a fresh cas_ctl (~600 bytes per

occurrence).

Fix it by freeing cas_ctl on the spi_async() error path. While here,

correct the misleading error string: the function calls spi_async(),

not spi_sync().