CVE-2026-72214

Received Received - Intake

Reference Leak in Linux Kernel CPCAP Battery Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak In cpcap_battery_detect_battery_type(), the reference to an nvmem device obtained via nvmem_device_find() is not released with nvmem_device_put() on the success or read-failure paths, causing a permanent reference leak. The driver’s retry logic on subsequent battery property reads can compound this leak, preventing the nvmem device from ever being freed. Found by code review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72214

EUVD

EUVD-2026-58972

Affected Vendors & Products

Vendor	Product	Version / Range
power	supply	cpcap-battery

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a reference leak vulnerability in the Linux kernel's power supply subsystem, specifically in the cpcap-battery driver. When detecting battery type, the code fails to release a reference to an nvmem device after obtaining it, causing a permanent memory leak. This happens on both success and read-failure paths.

Detection Guidance

This vulnerability is specific to the Linux kernel's power supply subsystem, particularly the cpcap-battery driver. Detection requires checking for reference leaks in the nvmem device handling within the driver. No direct network detection commands are applicable. Inspect kernel logs for warnings or errors related to nvmem or battery driver operations.

Impact Analysis

The vulnerability causes a gradual depletion of system resources over time. As the nvmem device reference is never released, repeated battery property reads will compound the leak, eventually leading to resource exhaustion. This may cause system instability or crashes in devices using this driver.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a reference leak in the Linux kernel's power supply subsystem, not a data breach or privacy issue.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. Monitor kernel logs for nvmem-related errors or warnings. If custom kernel builds are used, ensure the cpcap-battery driver is updated to include the nvmem_device_put() fix.

Hi! I’m here to help you understand CVE-2026-72214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70