CVE-2026-72039 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
If the allocation of fp[i].tpa_info fails, the error path will not free
the struct bnx2x_fastpath allocated earlier, as it is not linked to the bp structure yet. Fix that by linking it immediately after allocation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the bnx2x network driver component of the Linux kernel, specifically in the bnx2x_alloc_mem_bp() function where a potential memory leak can occur under certain error conditions. The issue stems from improper resource management during the allocation process for fastpath structures, creating a scenario where allocated memory remains unreleased when subsequent allocations fail. The vulnerability represents a classic memory management flaw that can lead to gradual resource exhaustion and system instability over time.
The technical flaw manifests when the function attempts to allocate memory for fp[i].tpa_info structures but encounters an allocation failure. During this error path, the code fails to properly clean up previously allocated bnx2x_fastpath structures that were allocated earlier in the function execution. This occurs because the fastpath structure is not yet linked to the main bp structure at the point where the error condition is detected, leaving the memory in an inconsistent state where the allocation is never properly freed. The issue directly relates to CWE-401 which categorizes improper resource management and memory leaks in software systems.
The operational impact of this vulnerability extends beyond simple memory consumption issues as it can lead to progressive system degradation and potential denial of service conditions. When multiple error paths are triggered during network driver initialization or operation, the accumulated unreleased memory can consume significant system resources, potentially causing system crashes or severe performance degradation. Network administrators may observe increasing memory usage over time without clear correlation to user activities, making this a particularly insidious issue that can remain undetected for extended periods.
The fix implemented addresses this vulnerability by ensuring that bnx2x_fastpath structures are linked to the bp structure immediately after allocation, regardless of subsequent allocation outcomes. This immediate linking ensures that all allocated resources can be properly tracked and freed during error handling paths, maintaining consistent memory management throughout the function execution. The solution aligns with standard security practices for resource management and follows the principle of defensive programming where all allocated resources are accounted for in error handling paths.
This vulnerability type falls under ATT&CK technique T1490 which covers "Inhibit System Recovery" through resource exhaustion attacks, though this particular case represents an internal memory management issue rather than an external attack vector. The fix demonstrates proper adherence to memory safety principles and helps maintain the overall stability and reliability of network operations within Linux systems, particularly in high-performance networking environments where the bnx2x driver is commonly deployed. Organizations should ensure that kernel updates incorporating this fix are applied promptly to maintain system integrity and prevent potential resource exhaustion scenarios that could impact network availability and system performance.