CVE-2026-72314

HIGHPre-NVD 7.87.8
EchelonGraph scoreHIGH confidence

Score 7.8 from GitHub Security Advisory (severity: HIGH) published 2026-08-15. a secondary CVSS source baseline 7.8; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, secondary
Trending — 5 sources updated this week
7.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 7.8Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK

Compare against -EDEADLK, which is what ww_mutex_lock() actually returns and what every other deadlock check in this file already uses.

Function regulator_lock_two() acquires two regulators via regulator_lock_nested() -> ww_mutex_lock(). On contention, ww_mutex_lock() returns -EDEADLK, which is the caller's signal to drop the lock it holds and retry the acquisition in the canonical order.

However, regulator_lock_two() tests the return value against -EDEADLOCK rather than -EDEADLK. On most architectures, EDEADLK and EDEADLOCK are the same value, so the comparison happens to be correct and the bug is invisible. But on MIPS, SPARC, and PowerPC, those two errors have different values. The test is wrong: a genuine -EDEADLK backoff no longer matches -EDEADLOCK, so instead of unlocking and retrying, the code falls into WARN_ON(ret) and returns with only one of the two regulators locked.

In practice, this is a bug only on MIPS, because the regulator core is not built or used on the other two platforms.

In general, EDEADLK is preferred over EDEADLOCK for new code.

CVSS v3
7.8
EG Score
7.8(high)
EG Risk
40(Track)
EG Risk 40/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity78% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
7%
KEV
Not listed

Published

August 15, 2026

Last Modified

August 17, 2026

Advisory Details (8)

Auto-updated Aug 17, 2026
No patch confirmed yet.
generic

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/e2063307ea3b6da74585129ba7b588e8243e2ef0
generic

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/dc804f390fddd9c389edf0976356942e16878d8f
generic

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/d38f8bd771c4999b797d7074b348cf201414bd34
generic

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/8e39aa63798ea0a797fd9341419f12ef91df3238
generic

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/346e2d666a29ae7233c56b356a0487eb1d42589b
generic

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/29a7953e9adea6c7f9e64947745b79158e7cea7f
generic

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/153d1b8b5bc30847eb70ad535f62f289aa9217e6
generic

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/0c305eac40470a224671858a215963b070f9b2a9

Vendor Advisories for CVE-2026-72314(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Data Freshness Timeline

(refreshed 30× in last 7d / 30× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-20 22:56 UTCEPSS rescore
  2. 2026-08-20 15:30 UTCGHSA enrichment
  3. 2026-08-20 04:06 UTCEG score recompute
  4. 2026-08-20 04:06 UTCGHSA enrichment
  5. 2026-08-19 17:04 UTCEPSS rescore
  6. 2026-08-19 16:42 UTCGHSA enrichment
  7. 2026-08-19 05:16 UTCGHSA enrichment
  8. 2026-08-18 17:50 UTCEG score recompute
  9. 2026-08-18 17:50 UTCGHSA enrichment
  10. 2026-08-18 13:49 UTCEPSS rescore
  11. 2026-08-18 13:49 UTCEPSS rescore
  12. 2026-08-18 06:23 UTCGHSA enrichment
  13. 2026-08-17 19:00 UTCEG score recompute
  14. 2026-08-17 19:00 UTCGHSA enrichment
  15. 2026-08-17 13:47 UTCEPSS rescore
  16. 2026-08-17 06:19 UTCEG score recompute
  17. 2026-08-17 06:19 UTCGHSA enrichment
  18. 2026-08-17 05:59 UTCEG score recompute 7.80
  19. 2026-08-17 05:59 UTCGHSA enrichment
  20. 2026-08-17 05:54 UTCMITRE cvelistV5CVSS v3 → 7.8 · severity → HIGH
  21. 2026-08-17 05:30 UTCEG score recompute
  22. 2026-08-17 05:30 UTCGHSA enrichment
  23. 2026-08-17 05:25 UTCMITRE cvelistV5
  24. 2026-08-16 14:56 UTCEPSS rescore
  25. 2026-08-16 14:56 UTCEPSS rescore
Show 5 more
  1. 2026-08-16 02:15 UTCEPSS rescore
  2. 2026-08-15 06:37 UTCGHSA enrichment
  3. 2026-08-15 06:23 UTCNVD update
  4. 2026-08-15 06:07 UTCEG score recompute
  5. 2026-08-15 06:02 UTCMITRE cvelistV5first tracked

Frequently asked(5)

What is CVE-2026-72314?
CVE-2026-72314 is a high vulnerability published on August 15, 2026. In the Linux kernel, the following vulnerability has been resolved: regulator: core: regulatorlocktwo() should test for EDEADLK not EDEADLOCK Compare against -EDEADLK, which is what wwmutexlock() actually returns and what every other deadlock check in this file already uses. Function…
When was CVE-2026-72314 disclosed?
CVE-2026-72314 was first published in the National Vulnerability Database on August 15, 2026, with the most recent update on August 17, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-72314 actively exploited?
CVE-2026-72314 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 92.6% of all scored CVEs.
What is the CVSS score of CVE-2026-72314?
CVE-2026-72314 has a CVSS v3 base score of 7.8 (NVD).
How do I remediate CVE-2026-72314?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-72314, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-72314

Explore →

Is Your Infrastructure Affected by CVE-2026-72314?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.