CVE-2026-72240: mfd: sm501: Fix reference leak on failed device registration

Received
AliasesUBUNTU-CVE-2026-72240DEBIAN-CVE-2026-72240
Published 15-08-2026Last modified 17-08-2026

Vulnerability summary

CVE-2026-72240 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.5% of scored vulnerabilities.

Priority
Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 16
SUSE-SU-2026:5091-1USN-8875-1USN-8875-2USN-8876-1USN-8877-1USN-8878-1

Timeline

  1. 15-08-2026
    PublishedVulnerability first disclosed.
  2. 17-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platform_device_register() fails in sm501_register_device(), the embedded struct device in pdev has already been initialized by device_initialize(), but the failure path only reports the error and returns without dropping the device reference for the current platform device: sm501_register_device() -> platform_device_register(pdev) -> device_initialize(&pdev->dev) -> setup_pdev_dma_masks(pdev) -> platform_device_add(pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error. The issue was identified by a static analysis tool I developed and confirmed by manual review.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

13%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.22% on 06-10-2026

06-10-202605-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: not stated in public data.

Ubuntu169 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-147.147 | < 7.0.0-38.38
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1067.70 | < 7.0.0-1014.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.180-1 | < 6.12.100-1 | < 7.1.5-1
Linux1 product
  • linux≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < bbb1ecaed4ed7680e63d3a0f143f03de32de5d6e | ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < e2dac91380a10e9e8d5883fb73ce9d9b390a629c | ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < 0baf9d43a7b7b43df2900bd8656e75b725028b6e | ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < a3e340d506c1036a747fb0972aebf1063f7ef30e | ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < 760a1029692f1d788dc11aa636a3bf432e58b240 | ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < 16a42c88c4667fa0bd944e438a667e059551f1f1 | ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < 2ff8156fd500d54c61430b6834137fd0a07047ce | ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < 8c2f0b42fc252e1bf1c7746447091a468e784ca1 | 2.6.21

3 vendors · 171 products

References

27 links
Show all 27 references