Medium [CVE-2026-72424] fix NULL deref in shared IRQ handler at probe

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and &pdev->dev as the cookie, but platform_set_drvdata() is only called later after the clock setup.

With a shared IRQ line, another device on the same line can trigger the handler in that window. The handler does dev_get_drvdata() on the cookie, gets NULL, and dereferences priv->rtc_base in interrupt context.

Pass priv as the cookie directly so the handler reads it from dev_id without the lookup, removing the dependency on probe order. During the probe phase, a shared Interrupt Request (IRQ) handler could be triggered by another device before the necessary driver data was fully initialized.

This could lead to a null pointer dereference, where the system attempts to access an invalid memory location. A local attacker could potentially exploit this to cause a system crash, leading to a denial of service.

Red Hat severity: Low — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476.

Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.