CVE-2026-72026

Received Received - Intake

irqchip IMSIC Early State Setup Failure Leads to fwnode Leak

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsic_early_acpi_init() allocates a firmware node before setting up the IMSIC state. If imsic_setup_state() fails, the function returns without freeing the allocated fwnode. Free the fwnode and clear the global pointer on this error path, matching the cleanup already done when imsic_early_probe() fails. [ tglx: Use a common cleanup path instead of copying code around ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72026

EUVD

EUVD-2026-58984

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory leak vulnerability in the Linux kernel's IMSIC (RISC-V Incoming Message-Signaled Interrupt Controller) early initialization code. When setting up the IMSIC state fails during ACPI initialization, the function does not properly free a previously allocated firmware node, causing a resource leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's IMSIC early initialization and may not have direct network detection methods. Check kernel logs for imsic_early_acpi_init() failures or memory leaks related to firmware nodes using dmesg | grep imsic or journalctl -k | grep imsic.

Impact Analysis

The impact is limited to systems using RISC-V with ACPI initialization. The memory leak could gradually consume system resources over time, potentially leading to degraded performance or unexpected behavior in interrupt handling. However, the leak is contained to a single initialization failure path.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a memory leak in the Linux kernel's IMSIC state setup, which could lead to resource exhaustion but does not involve data breaches or privacy violations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel logs for imsic-related errors after applying updates.

Hi! I’m here to help you understand CVE-2026-72026. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70