CVE-2026-72223

Received Received - Intake

Memory Leak in Linux Kernel nvdimm/btt

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arena sub-allocations on discover_arenas() error path Memory allocated by btt_freelist_init(), btt_rtt_init(), and btt_maplocks_init() is not freed on some discover_arenas() error paths. This leaks memory when arena discovery fails. Add the missing kfree() calls to release the allocations before returning an error. [ as: commit message and log edits ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72223

EUVD

EUVD-2026-59122

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves memory leaks in the nvdimm/btt subsystem. When arena discovery fails during system operation, memory allocated for certain data structures is not properly freed, leading to resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's nvdimm/btt module and does not have direct network detection methods. Check kernel logs for memory leak warnings or errors related to nvdimm/btt using dmesg or journalctl. Look for failed arena discovery events.

Impact Analysis

The memory leak could gradually consume system memory over time, potentially causing performance degradation or system instability if arena discovery fails repeatedly. This may lead to crashes or require system reboots to reclaim memory.

Compliance Impact

This vulnerability involves memory leaks in the Linux kernel's nvdimm/btt component due to missing kfree() calls during error paths. It does not directly impact data privacy or security controls required by standards like GDPR or HIPAA.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel logs for related errors and apply kernel updates from your distribution's official repositories.

Hi! I’m here to help you understand CVE-2026-72223. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70