CVE-2026-72026
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsic_early_acpi_init() allocates a firmware node before setting up the IMSIC state. If imsic_setup_state() fails, the function returns without freeing the allocated fwnode. Free the fwnode and clear the global pointer on this error path, matching the cleanup already done when imsic_early_probe() fails. [ tglx: Use a common cleanup path instead of copying code around ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72026
EUVD
EUVD-2026-58984

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory leak vulnerability in the Linux kernel's IMSIC (RISC-V Incoming Message-Signaled Interrupt Controller) early initialization code. When setting up the IMSIC state fails during ACPI initialization, the function does not properly free a previously allocated firmware node, causing a resource leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's IMSIC early initialization and may not have direct network detection methods. Check kernel logs for imsic_early_acpi_init() failures or memory leaks related to firmware nodes using dmesg | grep imsic or journalctl -k | grep imsic.

Impact Analysis

The impact is limited to systems using RISC-V with ACPI initialization. The memory leak could gradually consume system resources over time, potentially leading to degraded performance or unexpected behavior in interrupt handling. However, the leak is contained to a single initialization failure path.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel logs for imsic-related errors after applying updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72026. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart