CVE-2026-72485

Received Received - Intake

Kernel Memory Leak in Linux CoreSight Platform

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresight_add_out_conn() increments nr_outconns before calling devm_krealloc_array() and again before devm_kmalloc(). If either allocation fails, the counter is already bumped while the corresponding array entry is NULL or uninitialized garbage. coresight_add_in_conn() has the same problem with nr_inconns and devm_krealloc_array(). In both cases the probe returns -ENOMEM, which causes coresight_get_platform_data() to call coresight_release_platform_data() for cleanup. That function iterates up to nr_outconns (or nr_inconns) entries and dereferences each pointer unconditionally, hitting the NULL or garbage entry and panicking instead of failing gracefully. Fix by moving the counter increments to after all allocations succeed, so the struct is always consistent on any error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72485

EUVD

EUVD-2026-59384

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	coresight	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's coresight subsystem. It involves incorrect handling of connection counters during memory allocation failures. When allocating memory for output or input connections, the counters are incremented before the allocation succeeds. If allocation fails, the counters remain incremented while the corresponding array entries are invalid, leading to potential system crashes when cleanup code dereferences these invalid entries.

Detection Guidance

This vulnerability is specific to the Linux kernel's coresight subsystem and may not have direct network detection methods. Check kernel logs for coresight-related errors or panics using: dmesg | grep coresight. If the system crashes or shows NULL pointer dereference errors in coresight functions, it may indicate exploitation.

Impact Analysis

This vulnerability can cause kernel panics or system crashes when coresight subsystem cleanup is triggered. If you use systems with coresight functionality, such as certain ARM-based devices, this flaw could lead to unexpected reboots or denial of service conditions. It does not directly expose data but may disrupt system stability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue in the coresight subsystem that could lead to system crashes (kernel panic) due to improper error handling. Compliance impacts would only occur if the crash caused data loss or unavailability, which is not specified in the provided context.

Mitigation Strategies

Update the Linux kernel to the latest patched version where this issue is resolved. If immediate patching is not possible, disable the coresight subsystem by blacklisting the coresight modules or restricting access to coresight device files in /dev.

Hi! I’m here to help you understand CVE-2026-72485. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70