CVE-2026-72406
Received Received - Intake

Double Free in Linux Kernel's sungem Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup gem_init_one() calls gem_remove_one() when register_netdev() fails. gem_remove_one() unregisters and frees resources owned by the net_device, including the DMA block, MMIO mapping, PCI regions, and the net_device itself. gem_init_one() then falls through to its own cleanup labels and frees the same resources again. Keep the register_netdev() error path in gem_init_one(): clear drvdata so PM/remove paths do not see a half-registered device, remove the NAPI instance added during probe, and let the existing cleanup labels release the resources once. The issue was found by a local static-analysis checker for probe error paths. The reported path was manually inspected before sending this fix. Compile-tested with CONFIG_SUNGEM=y. Runtime testing was not performed because no sungem hardware is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72406
EUVD
EUVD-2026-59305

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a double-free issue during network device driver initialization. When register_netdev() fails in gem_init_one(), it calls gem_remove_one() which frees resources like DMA blocks and PCI regions. gem_init_one() then proceeds to free the same resources again in its cleanup labels, causing a crash or instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's sungem network driver and involves a double-free issue during probe error handling. Detection requires checking kernel logs for sungem driver errors or crashes during device initialization. No direct commands are provided in the context, but monitoring dmesg for sungem-related errors may help identify the issue.

Impact Analysis

This could cause system crashes, kernel panics, or instability when a specific network card (sungem) fails to initialize properly. It may lead to denial-of-service conditions if the affected driver is in use.

Mitigation Strategies

Apply the kernel patch that fixes the sungem driver's probe error cleanup. Update to a kernel version containing the fix. If sungem hardware is not in use, disabling the driver via kernel configuration may also mitigate the risk.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72406. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart