CVE-2026-72145

Received Received - Intake

Memory Leak in Linux Kernel TPMI Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in mem_write() In mem_write(), the temporary array returned by parse_int_array_user() must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so it is freed automatically on return. This also moves the array declaration next to parse_int_array_user() as required by cleanup.h usage guidelines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72145

EUVD

EUVD-2026-58903

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory management vulnerability in the Linux kernel's Intel TPMI (Type-C Platform Module Interface) driver. The issue occurs in the mem_write() function where a temporary array allocated by parse_int_array_user() is not properly freed on all exit paths, leading to a potential memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's platform/x86/intel/tpmi module. Detection requires checking the kernel version and examining the affected code path. Use commands like 'uname -a' to check the kernel version and 'grep -r tpmi /lib/modules/$(uname -r)/' to locate the module. If the kernel is vulnerable, the mem_write function may lack proper cleanup handling.

Impact Analysis

This vulnerability could lead to memory exhaustion over time if the mem_write() function is called repeatedly. This might cause system instability, crashes, or degraded performance due to resource depletion.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue is a memory management flaw in the Linux kernel's platform/x86/intel/tpmi module, which could lead to resource leaks but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this issue is resolved. If immediate patching is not possible, consider disabling the tpmi module using 'modprobe -r intel_tpmi' or blacklisting it in '/etc/modprobe.d/'. Monitor vendor advisories for kernel updates addressing this CVE.

Hi! I’m here to help you understand CVE-2026-72145. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70