Bug 2516328 (CVE-2026-72453)

Summary: CVE-2026-72453 kernel: regcache: Do not overwrite error code when finalizing cache after error
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `regcache` mechanism. During initialization, an error in a specific callback function (`cache_ops->populate`) can have its error code overwritten by a subsequent exit routine. This masks the original error, potentially causing the system to attempt operations on uninitialized memory. Such actions can result in NULL pointer dereferences, leading to system instability or a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:06:44 UTC 
In the Linux kernel, the following vulnerability has been resolved:

regcache: Do not overwrite error code when finalizing cache after error

During regcache initialization, if an error occurs in the
cache_ops->populate callback, and if cache operations include an exit
callback, the error code from populate() is overwritten with the return
value from exit(). This hides the error condition from the caller of
regcache_init(), and can cause NULL pointer dereferences when the regcache
is later accessed.
Comment 1 gkamathe 2026-08-19 14:03:47 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-72453-a018@gregkh/T