CVE-2026-72214 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
In cpcap_battery_detect_battery_type(), the reference to an nvmem device obtained via nvmem_device_find() is not released with nvmem_device_put() on the success or read-failure paths, causing a permanent reference leak. The driver’s retry logic on subsequent battery property reads can compound this leak, preventing the nvmem device from ever being freed.
Found by code review.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the linux kernel's power supply subsystem specifically in the cpcap-battery driver which manages battery charging and monitoring for certain hardware platforms. The issue manifests as a reference leak in the nvmem device handling mechanism that occurs during battery type detection operations. When the cpcap_battery_detect_battery_type() function executes, it acquires a reference to an nvmem device using the nvmem_device_find() API call but fails to properly release this reference through the corresponding nvmem_device_put() function. This oversight creates a permanent memory reference leak that prevents the underlying nvmem device from being properly deallocated even when no longer needed.
The technical flaw stems from improper resource management within the driver's battery detection logic where the code path does not consistently handle the nvmem device reference cleanup regardless of whether the operation succeeds or fails during read attempts. This particular implementation pattern violates fundamental resource management principles and creates a persistent state where the nvmem device remains allocated in memory indefinitely. The vulnerability is particularly concerning because the driver includes retry logic for subsequent battery property reads, which means that each failed or successful attempt to read battery properties compounds the reference leak rather than resolving it.
The operational impact of this vulnerability extends beyond simple memory consumption as it can lead to progressive resource exhaustion over time, especially in systems where battery monitoring occurs frequently. The persistent reference leak prevents proper cleanup of nvmem device resources which may eventually cause system instability or performance degradation. Additionally, since the nvmem device represents hardware-specific configuration data storage, the reference leak could potentially impact other driver operations that depend on these same nvmem resources. This type of resource leak directly corresponds to CWE-404, which addresses improper resource release or unbalanced resource management.
The vulnerability demonstrates characteristics consistent with ATT&CK technique T1547.006 which involves the exploitation of operating system mechanisms for persistence and privilege escalation through improper handling of system resources. While this specific case represents a memory leak rather than an active attack vector, it creates conditions that could be leveraged by malicious actors to exhaust system resources or create denial-of-service scenarios. The issue was identified through code review methodology which highlights the importance of systematic security analysis in preventing such resource management defects.
Mitigation strategies should focus on implementing proper reference counting and resource cleanup mechanisms within the driver's battery detection logic. The fix requires ensuring that every successful nvmem_device_find() call has a corresponding nvmem_device_put() invocation regardless of whether subsequent operations succeed or fail. System administrators should monitor for unusual memory consumption patterns in systems running affected kernel versions, particularly those using cpcap-battery drivers. Kernel updates containing the fix should be deployed immediately to address this vulnerability, and organizations should consider implementing automated patch management processes to prevent similar issues from accumulating in their environments. The vulnerability underscores the critical importance of thorough code review processes and comprehensive testing of resource management patterns within kernel drivers.