CVE-2026-72224 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/btt: Free arenas on btt_init() error paths
The arenas allocated by discover_arenas() or create_arenas() are not freed on some error paths in btt_init(). This leaks memory when BTT initialization fails.
Call free_arenas() from the affected error paths to release the allocations.
[ as: commit message and log edits ]
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's nvdimm subsystem where the Bad Block Table (BTT) initialization process contains a memory leak condition. The issue occurs when the btt_init() function fails during the initialization of BTT structures, specifically when dealing with arena allocations that are not properly cleaned up on error paths. The vulnerability stems from the failure to invoke the free_arenas() function in certain error conditions, leading to persistent memory allocation that cannot be reclaimed by the system.
The technical flaw manifests in the nvdimm/btt subsystem where discover_arenas() and create_arenas() functions allocate memory for arena structures but do not ensure proper cleanup when subsequent operations within btt_init() fail. This represents a classic resource leak pattern where allocated memory remains in use even after the initialization process terminates unsuccessfully. The flaw is categorized under CWE-401 as a failure to release memory resources, specifically manifesting in improper error handling within kernel memory management routines.
The operational impact of this vulnerability extends beyond simple memory consumption issues as it can lead to progressive memory exhaustion on systems with frequent BTT initialization attempts or those operating under memory-constrained conditions. When BTT initialization fails repeatedly due to various reasons such as hardware errors, corrupted metadata, or configuration issues, each failure results in unreclaimed memory allocations that accumulate over time. This degradation affects system stability and performance, particularly in environments where persistent memory devices are actively managed or where automated recovery mechanisms attempt multiple initialization cycles.
The recommended mitigation strategy involves implementing proper error path handling within the btt_init() function to ensure that free_arenas() is invoked whenever discover_arenas() or create_arenas() fail during the initialization sequence. This fix aligns with standard kernel development practices for resource management and follows ATT&CK technique T1490 for Resource Hijacking by preventing improper memory usage patterns. The solution demonstrates proper defensive programming principles where every allocation has a corresponding deallocation, even in error conditions, thereby maintaining system memory integrity and preventing potential denial-of-service scenarios that could arise from progressive memory exhaustion.
This vulnerability type falls under the broader category of kernel memory management issues that can be exploited to cause system instability or performance degradation through resource exhaustion attacks. The fix represents a fundamental correction to the initialization error handling logic that ensures proper cleanup regardless of the execution path taken during BTT setup operations, aligning with established security practices for maintaining system reliability and preventing resource leakage conditions in kernel space operations.