CVE-2026-72223 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
Memory allocated by btt_freelist_init(), btt_rtt_init(), and btt_maplocks_init() is not freed on some discover_arenas() error paths. This leaks memory when arena discovery fails.
Add the missing kfree() calls to release the allocations before returning an error.
[ as: commit message and log edits ]
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's nvdimm subsystem, specifically affecting the block translation table implementation that manages persistent memory devices. The issue manifests as a memory leak occurring during the arena discovery process when the discover_arenas() function encounters an error condition. The flaw represents a classic resource management oversight where allocated kernel memory structures are not properly released when error paths are taken during initialization sequences.
The technical root cause involves three specific initialization functions within the btt subsystem that allocate memory resources but fail to release them appropriately. These functions include btt_freelist_init(), btt_rtt_init(), and btt_maplocks_init() which all perform memory allocations using kernel allocation mechanisms such as kmalloc or similar primitives. When discover_arenas() encounters an error during its execution flow, it returns early without executing the cleanup code that would normally call kfree() on these allocated structures, resulting in memory leaks that persist until the system reboots or the memory is explicitly freed through other means.
The operational impact of this vulnerability extends beyond simple memory consumption issues, as it can lead to progressive memory exhaustion on systems running persistent memory workloads. This type of memory leak represents a denial-of-service vector where sustained operation with failing arena discovery scenarios could gradually consume available kernel memory, potentially affecting system stability and performance. The vulnerability affects systems utilizing nvdimm (non-volatile dual in-line memory module) devices that rely on block translation tables for managing persistent memory regions.
From a cybersecurity perspective, this vulnerability maps to CWE-401: "Improper Release of Memory Before Removing Last Reference" and aligns with ATT&CK technique T1490: "Inhibit System Recovery" through memory exhaustion attacks. The fix implemented involves adding explicit kfree() calls before error returns in the discover_arenas() function, ensuring that all allocations from the three identified initialization functions are properly released regardless of execution path taken. This remediation follows established kernel development practices for resource management and error handling, aligning with the principle of defensive programming where resources must be freed on all code paths including error conditions.
The vulnerability demonstrates how complex kernel subsystems can exhibit subtle memory management issues when error handling paths are not carefully considered during development. The fix represents a straightforward but critical correction that ensures proper resource cleanup, maintaining system stability and preventing potential exploitation through memory exhaustion attacks targeting the persistent memory subsystem. This class of vulnerability highlights the importance of comprehensive testing of error paths in kernel code and adherence to established memory management best practices within the Linux kernel development community.