CVE-2026-72171

HighCVSS 7.8/10Last modified Aug 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: slram: remove failed entries from the device list

register_device() links a new slram_mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the global list. A later cleanup can then dereference or free invalid state from that failed entry.

Unwind the partially initialized entry and clear the list tail on each failure path after the entry has been linked.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 15, 2026
Last modified
Aug 17, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-721727.8In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE If DAX memoCVE-2026-72173In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: do not warn on seeing non-migration pmd entry Patch CVE-2026-72174In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() CVE-2026-721757.1In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race Patch sCVE-2026-72176In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error CVE-2026-72177In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()CVE-2026-72178In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damon_cCVE-2026-72179In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populate_cache_leaves CurCVE-2026-72187.2A vulnerability was detected in Totolink N300RT 3.4.0-B20250430. The impacted element is the function is_cmd_string_valid of the file /boafrCVE-2026-72180In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgradCVE-2026-721817.8In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASK_OFFSTACK memory corruption This patch addressCVE-2026-72182In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in is_full_charged()
CVE-2026-72171: High severity, CVSS 7.8 | Vulnix