CVE-2026-72240 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
mfd: sm501: Fix reference leak on failed device registration
When platform_device_register() fails in sm501_register_device(), the embedded struct device in pdev has already been initialized by device_initialize(), but the failure path only reports the error and returns without dropping the device reference for the current platform device:
sm501_register_device() -> platform_device_register(pdev) -> device_initialize(&pdev->dev) -> setup_pdev_dma_masks(pdev) -> platform_device_add(pdev)
This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error.
The issue was identified by a static analysis tool I developed and confirmed by manual review.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a memory management flaw in the Linux kernel's sm501 multi-function device driver that falls under the category of resource leak vulnerabilities. This issue specifically affects the mfd (Multi-Function Device) subsystem where the sm501 driver handles graphics and display controller functionality for certain embedded systems. The problem manifests when device registration fails during the platform device initialization process, creating a scenario where kernel memory resources remain allocated without proper cleanup.
The technical root cause of this vulnerability lies in the improper handling of reference counting within the device registration workflow. When sm501_register_device() attempts to register a platform device, it calls platform_device_register() which internally invokes device_initialize() to initialize the embedded struct device within the platform device structure. However, when platform_device_register() fails and returns an error code, the function does not properly clean up the reference count that was incremented during device initialization. This creates a memory leak where the platform device reference remains unreleased even though the registration process has terminated unsuccessfully.
According to CWE classification, this vulnerability maps to CWE-404: Improper Resource Transfer, specifically involving improper handling of reference counting in kernel space memory management. The flaw demonstrates characteristics consistent with resource management issues that can lead to system instability and potential denial of service conditions when multiple failed device registrations occur sequentially. The static analysis tool used to identify this issue highlights the importance of proper error path handling in kernel code where resource cleanup must occur regardless of success or failure outcomes.
The operational impact of this reference leak can be significant in embedded systems that rely heavily on the sm501 driver for graphics functionality, particularly those with limited memory resources. While individual leaks may appear minor, repeated occurrences during system initialization or device hot-plugging scenarios can accumulate and lead to memory exhaustion. The vulnerability affects systems using the SM501 graphics controller such as certain embedded computers and industrial devices that require this specific display hardware support. From an attack perspective, this could potentially be exploited in resource exhaustion attacks against embedded systems where the failure paths are repeatedly triggered.
The fix implemented addresses the immediate issue by ensuring proper cleanup through the addition of platform_device_put() before returning error codes from sm501_register_device(). This solution follows established kernel development practices for reference counting management and adheres to the principle that all resources allocated during a function execution must be properly released regardless of success or failure outcomes. The fix aligns with ATT&CK framework concept T1499.004: Network Denial of Service, as resource leaks can contribute to system instability and availability issues in embedded environments where memory constraints are critical. This remediation ensures that the kernel's device management subsystem maintains proper reference counting semantics and prevents potential memory consumption degradation over time.