High 7.8Published Aug 15, 2026

CVE-2026-72109net: sparx5: unregister blocking notifier on init failure

Updated under an hour ago (Oct 27, 2026, 2:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5_register_notifier_blocks() registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregisters the switchdev and netdevice notifiers, but leaves the blocking notifier registered. Add a separate error label for the workqueue allocation failure path and unregister the switchdev blocking notifier there.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d6fce5141929697a27f029c633433d487f6f62cb before fbc65b17508ed5464b7106e7fa5f15251ca1b603; from d6fce5141929697a27f029c633433d487f6f62cb before e5afc6d3fabdf1f605d63c4b34a3df6c359e81f3; from d6fce5141929697a27f029c633433d487f6f62cb before cf419c869e0d03aad4b6f4ecf0a813851930dfe7; from d6fce5141929697a27f029c633433d487f6f62cb before d6084c47389fd6978a5d66b0d58206a548c792a9; from d6fce5141929697a27f029c633433d487f6f62cb before 8a3c44a003176282ee4306b7c96e5a536c6f0707; from d6fce5141929697a27f029c633433d487f6f62cb before 17f113e7b622dc850992ade540181717de6a8561; from d6fce5141929697a27f029c633433d487f6f62cb before 483be61b4a9a6df3b7cb277e8f189e082dee4cb8	CNA record

References

References

https://git.kernel.org/stable/c/fbc65b17508ed5464b7106e7fa5f15251ca1b603
https://git.kernel.org/stable/c/e5afc6d3fabdf1f605d63c4b34a3df6c359e81f3
https://git.kernel.org/stable/c/cf419c869e0d03aad4b6f4ecf0a813851930dfe7
https://git.kernel.org/stable/c/d6084c47389fd6978a5d66b0d58206a548c792a9
https://git.kernel.org/stable/c/8a3c44a003176282ee4306b7c96e5a536c6f0707
https://git.kernel.org/stable/c/17f113e7b622dc850992ade540181717de6a8561
https://git.kernel.org/stable/c/483be61b4a9a6df3b7cb277e8f189e082dee4cb8

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.