SB2026081634 - Race condition in Linux kernel microchip vcap driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081634

SB2026081634 - Race condition in Linux kernel microchip vcap driver

Published: August 16, 2026

Security Bulletin ID SB2026081634
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Race condition (CVE-ID: CVE-2026-72340)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to corrupt hardware rule entries.

The vulnerability exists due to a race condition in the microchip vcap api and debugfs rule dump handling when accessing shared Super VCAP instances concurrently. A local user can trigger concurrent rule dump and rule write operations to corrupt hardware rule entries.

The issue affects sparx5 and lan969x devices where IS0 and IS2 instances share the same Super VCAP hardware block, cache, and command registers.


Remediation

Install update from vendor's website.

References