CVE-2026-72050 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: Free BPID bitmap on setup failure
nix_setup_bpids() allocates bp->bpids with rvu_alloc_bitmap(), which uses a plain kcalloc(). If any of the following devm_kcalloc() allocations for the BPID mapping arrays fails, the function returns without freeing the bitmap. Free the BPID bitmap before returning from those error paths.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question relates to improper resource management within the Linux kernel's octeontx2 network driver, specifically affecting the nix_setup_bpids() function. This issue represents a memory leak scenario that occurs during hardware initialization when allocation failures happen in the bitmap management subsystem. The flaw manifests when the rvu_alloc_bitmap() function allocates bp->bpids using kcalloc(), but subsequent devm_kcalloc() allocations for BPID mapping arrays fail, leaving the allocated bitmap resources unreleased.
The technical implementation of this vulnerability stems from inadequate error handling within the setup function where multiple memory allocation operations are performed sequentially. When any of these allocations fails, the function exits immediately without executing cleanup routines to release previously allocated memory resources. This pattern violates fundamental resource management principles and creates a persistent memory leak that can accumulate over time, potentially leading to system instability or resource exhaustion. The vulnerability affects the octeontx2-af driver component which manages network interface hardware for Cavium ThunderX2 systems.
Operationally, this vulnerability presents significant risks in production environments where continuous system uptime is critical. Memory leaks can gradually consume available system resources, leading to performance degradation, system instability, or even complete system crashes under sustained load conditions. The impact extends beyond simple memory consumption as it can affect the reliability of network operations and potentially compromise the overall system security posture by creating resource exhaustion attack vectors. Network administrators may observe gradual performance degradation without clear correlation to specific events, making troubleshooting more challenging.
Mitigation strategies should focus on implementing proper error handling with comprehensive cleanup routines before function return paths. The solution requires modifying nix_setup_bpids() to ensure that any allocated bitmap resources are properly freed when allocation failures occur during setup operations. This aligns with established security practices and follows the principle of least privilege by ensuring that all allocated resources are properly accounted for and released. The fix should incorporate defensive programming techniques that adhere to industry standards such as those outlined in the Common Weakness Enumeration framework, specifically addressing CWE-404: Improper Resource Release or Cleanup. Additionally, this vulnerability demonstrates characteristics consistent with ATT&CK technique T1499.001: Endpoint Denial of Service, where resource exhaustion can be achieved through improper memory management practices.