CVE-2026-72140 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
If devm_platform_get_and_ioremap_resource() returns an error, mlxbf_i2c_init_resource() frees tmp_res before reading tmp_res->io to get the error code. This results in a use-after-free.
Save the error code before freeing tmp_res.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's i2c mlxbf driver represents a critical use-after-free condition that could potentially lead to system instability or security exploitation. This flaw exists within the mlxbf_i2c_init_resource() function where improper error handling creates a scenario wherein memory is freed before its contents are properly accessed. The issue specifically manifests when devm_platform_get_and_ioremap_resource() returns an error condition, triggering a problematic sequence of operations that violates fundamental memory safety principles.
The technical implementation of this vulnerability stems from the driver's resource management approach during initialization phases. When the platform resource acquisition function fails, the code attempts to access tmp_res->io to retrieve the error code while simultaneously executing a free operation on tmp_res itself. This creates a temporal race condition where the memory location referenced by tmp_res becomes invalid before the error value can be properly extracted and processed. The flaw demonstrates poor defensive programming practices where resource cleanup operations are performed prematurely without ensuring all necessary data has been safely extracted from freed memory regions.
From an operational perspective, this vulnerability poses significant risks to systems utilizing the Mellanox BlueField SoC platforms that rely on the i2c mlxbf driver for hardware communication. The use-after-free condition could potentially be exploited by malicious actors to corrupt kernel memory structures, leading to privilege escalation or system crashes. While the immediate impact may appear limited to the specific driver context, such vulnerabilities in core kernel components can provide footholds for more sophisticated attacks targeting system stability and security boundaries. The flaw aligns with CWE-416, which specifically addresses use-after-free conditions in software systems where memory is accessed after it has been freed.
The exploitation of this vulnerability would require specific conditions to be met, including successful initialization of the i2c driver component and subsequent failure of platform resource acquisition. However, given that kernel drivers operate with elevated privileges, any successful exploitation could result in severe consequences ranging from denial of service to full system compromise. The ATT&CK framework's T1068 entry regarding "Exploitation for Privilege Escalation" would be applicable here, as this vulnerability could potentially enable attackers to escalate their privileges within the kernel space through memory corruption techniques.
Security mitigations for this vulnerability focus on implementing proper error handling sequences that preserve error codes before memory deallocation occurs. The fix involves saving the error code returned by devm_platform_get_and_ioremap_resource() immediately upon detection of failure, ensuring that all necessary information is captured before tmp_res is freed and becomes inaccessible. This approach aligns with established secure coding practices that emphasize proper resource management and defensive programming techniques. System administrators should prioritize applying kernel updates containing this fix to prevent potential exploitation, particularly on systems utilizing Mellanox BlueField hardware platforms where the vulnerable driver is actively deployed and operational.