CVE-2026-72015

Received Received - Intake

Double-Free in Linux Kernel fs/resctrl

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list A pseudo-locked group's RMID is freed when it is created. On unmount rmdir_all_sub() unconditionally frees all RMID of all groups, resulting in a double-free of the pseudo-locked group's RMID. The consequence of this is that the original free results in the pseudo-locked group's RMID being added to the rmid_free_lru linked list and the second free then attempts to add the same RMID entry to the rmid_free_lru again. Do not double-free a pseudo-locked group's RMID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-05

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72015

EUVD

EUVD-2026-59114

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a double-free issue in the resctrl filesystem. When a pseudo-locked group's RMID is created, it is incorrectly freed. Later, during unmount operations, the system attempts to free the same RMID again, leading to a double-free condition. This results in the RMID being added twice to the rmid_free_lru linked list.

Detection Guidance

This vulnerability is specific to the Linux kernel's fs/resctrl module and involves a double-free issue with pseudo-locked regions' RMID. Detection requires checking kernel logs for errors related to RMID freeing or resctrl operations. Commands like dmesg | grep resctrl or journalctl -k | grep resctrl may help identify issues.

Impact Analysis

The double-free could cause memory corruption or kernel crashes, potentially leading to system instability or denial-of-service conditions. Systems using the resctrl filesystem with pseudo-locked groups may experience unexpected behavior or failures.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a memory management issue in the Linux kernel's resctrl filesystem. The flaw involves a double-free of a pseudo-locked group's RMID, which is a resource management problem rather than a data privacy or security issue.

Mitigation Strategies

Apply the latest kernel patch or update to a version where this issue is resolved. Avoid using pseudo-locked groups in resctrl until patched. Monitor kernel logs for RMID-related errors as a sign of exploitation or misconfiguration.

Hi! I’m here to help you understand CVE-2026-72015. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70