CVE-2026-72059 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
t7xx_cldma_late_init() creates md_ctrl->gpd_dmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized rings but leaves the DMA pool allocated.
Destroy md_ctrl->gpd_dmapool on the late-init failure path to avoid leaking the DMA pool.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's WWAN subsystem, specifically within the t7xx driver implementation that manages communication with certain cellular modems. This issue represents a resource management flaw that occurs during the late initialization phase of the CLDMA (Centralized Local Direct Memory Access) controller. The problem manifests when the t7xx_cldma_late_init() function attempts to initialize the modem's TX and RX rings while simultaneously creating a DMA pool for GPD (Guardian Packet Descriptor) structures. The sequence of operations creates a potential memory leak scenario where allocated resources are not properly cleaned up upon initialization failure.
The technical flaw stems from improper error handling within the initialization routine where the DMA pool allocation occurs before ring initialization. When subsequent ring initialization fails, the cleanup code appropriately frees the ring structures but fails to destroy the previously allocated DMA pool. This creates a persistent resource leak that can accumulate over time and potentially lead to system instability or resource exhaustion. The vulnerability is classified as a memory leak under CWE-401 and represents a failure in proper resource management during error conditions. The issue impacts the reliability of the WWAN subsystem and could potentially provide an avenue for denial-of-service attacks by consuming available DMA pool resources.
The operational impact of this vulnerability extends beyond simple memory consumption, as it affects the overall stability and performance of devices relying on the t7xx modem driver. Systems utilizing these modems may experience gradual degradation in performance due to accumulated resource leaks, with potential complete failure of WWAN functionality if resource exhaustion occurs. The vulnerability is particularly concerning in embedded systems or mobile devices where memory resources are constrained and efficient resource utilization is critical for system operation. From an ATT&CK perspective, this weakness could enable a denial-of-service attack pattern through resource exhaustion, potentially affecting network connectivity and communication services.
Mitigation strategies should focus on implementing proper error handling that ensures all allocated resources are cleaned up regardless of initialization success or failure. The fix requires modifying the error path in t7xx_cldma_late_init() to destroy the DMA pool before returning from the function, ensuring that all memory allocated during initialization is properly freed. System administrators should apply kernel updates containing this fix immediately, particularly on devices running critical WWAN services or those deployed in environments where resource exhaustion could have severe consequences. Additional monitoring for resource usage patterns and implementing automated alerting for unusual memory consumption could provide early detection of potential exploitation attempts. The fix aligns with security best practices for resource management and proper error handling, reducing the attack surface while maintaining system stability and reliability for WWAN communications.