CVE-2026-72167

Received Received - Intake

PL353 NAND Controller Probe Resource Leak Fix

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe(), the devm_ioremap() is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x device in the devm_ioremap() instead of its parent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72167

EUVD

EUVD-2026-58925

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect resource handling during the probe phase of the mtd: rawnand: pl353 driver. The devm_ioremap() function is called with the parent device instead of the current device, causing the register area not to be released when the module is unloaded.

Detection Guidance

This vulnerability is specific to the Linux kernel's mtd rawnand pl353 driver and may not have direct network detection methods. Check kernel logs for errors related to pl353 or mtd during module loading/unloading. Commands like dmesg | grep pl353 or journalctl -k | grep pl353 may help identify issues.

Impact Analysis

This vulnerability may lead to resource leaks when the affected module is unloaded, potentially causing system instability or unexpected behavior due to unreleased memory or hardware registers.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory mapping issue with no clear impact on data protection or privacy.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-72167. If immediate update is not possible, avoid unloading the pl353 module to prevent resource leaks. Monitor system logs for related errors.

Hi! I’m here to help you understand CVE-2026-72167. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70