CVE-2026-72058
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ixp4xx_hss: fix duplicate HDLC netdev allocation ixp4xx_hss_probe() allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered with register_hdlc_device(). The second one is stored in port->netdev and later used by the remove path for unregister_hdlc_device() and free_netdev(). This means that the registered netdev is not the same object that is unregistered and freed on remove. It also leaks the first allocation if the second alloc_hdlcdev() call fails, and the first allocation is not checked before ndev is used. Older code allocated the HDLC netdev only once and stored the same object in both the local variable and port->netdev. The buggy conversion split this into two alloc_hdlcdev() calls. A later rename changed the local variable name to ndev, but the underlying mismatch remained. Fix this by allocating the HDLC netdev only once and assigning the same object to port->netdev.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72058
EUVD
EUVD-2026-59016

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of HDLC network device allocations in the ixp4xx_hss driver. The code allocates two separate network devices but only registers one, causing a mismatch where the wrong device is freed during cleanup. This can lead to memory leaks or use-after-free issues if the second allocation fails.

Detection Guidance

This vulnerability is specific to the Linux kernel's ixp4xx_hss driver and involves improper handling of HDLC netdev allocations. Detection requires checking if the affected driver is loaded and examining kernel logs for related errors or mismatches during device registration and removal.

Impact Analysis

If exploited, this flaw could cause system instability, crashes, or privilege escalation on affected Linux systems using the ixp4xx_hss driver. It may also lead to denial-of-service conditions or data corruption due to improper resource management.

Mitigation Strategies

Apply the kernel patch that resolves the duplicate HDLC netdev allocation issue in the ixp4xx_hss driver. Ensure your Linux kernel is updated to a version containing the fix. Monitor system logs for errors related to HDLC device registration or removal.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart