CVE-2026-72240

Received Received - Intake

Reference Leak in Linux Kernel mfd sm501 Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platform_device_register() fails in sm501_register_device(), the embedded struct device in pdev has already been initialized by device_initialize(), but the failure path only reports the error and returns without dropping the device reference for the current platform device: sm501_register_device() -> platform_device_register(pdev) -> device_initialize(&pdev->dev) -> setup_pdev_dma_masks(pdev) -> platform_device_add(pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error. The issue was identified by a static analysis tool I developed and confirmed by manual review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72240

EUVD

EUVD-2026-59139

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a reference leak in the mfd: sm501 driver. When platform_device_register() fails during device registration, the embedded device structure is initialized but not properly cleaned up. The failure path does not drop the device reference, causing a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's mfd: sm501 driver and involves a reference leak during device registration failure. Detection requires checking kernel logs for sm501 device registration errors or analyzing kernel memory leaks using tools like kmemleak or sysfs memory tracking.

Impact Analysis

This vulnerability could lead to resource exhaustion over time due to unreleased device references. Systems using the affected Linux kernel component may experience memory leaks, potentially causing performance degradation or system instability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a reference leak in the Linux kernel's mfd: sm501 driver, which could lead to resource exhaustion but does not involve data breaches or unauthorized access.

Mitigation Strategies

Apply the kernel patch that fixes the reference leak in sm501_register_device(). Update to a Linux kernel version that includes the fix. Monitor kernel logs for sm501 device registration failures as a potential indicator of the issue.

Hi! I’m here to help you understand CVE-2026-72240. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70