CVE-2026-72245 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
After device_initialize(), the embedded struct device in struct host1x_device should be released through the device core with put_device().
In host1x_device_add(), if host1x_device_parse_dt() fails, the current error path frees the object directly with kfree(device). That bypasses the normal device lifetime handling and leaks the reference held on the embedded struct device.
The issue was identified by a static analysis tool I developed and confirmed by manual review.
Fix this by using put_device() in the host1x_device_parse_dt() failure path.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the linux kernel's host1x graphics subsystem where improper device reference handling leads to resource leaks. The host1x driver manages graphics processing unit operations through a complex device hierarchy that includes embedded device structures. When the host1x_device_add() function processes device tree parsing, it encounters a critical flaw in error handling that bypasses normal kernel device management protocols. The vulnerability stems from direct memory deallocation using kfree() instead of proper reference counting mechanisms that would normally occur through the device core subsystem.
The technical flaw manifests when host1x_device_parse_dt() fails during device tree parsing operations, which typically occurs when hardware descriptions cannot be properly interpreted or when required device properties are missing. In this error scenario, the code executes kfree(device) directly on the host1x_device structure rather than following the established pattern of releasing references through put_device(). This direct memory freeing bypasses the kernel's device reference counting system, leaving the embedded struct device with an unreleased reference that persists in memory even after the parent structure has been deallocated.
The operational impact of this vulnerability results in gradual resource exhaustion within the graphics subsystem where device references accumulate over time without proper cleanup. Each failed device tree parsing operation contributes to a growing memory leak that can eventually degrade system performance or cause complete subsystem failure. The leak occurs because the embedded device structure maintains a reference count that never decrements properly, causing the kernel's device management infrastructure to retain references to deallocated structures and preventing proper garbage collection of these resources.
This vulnerability maps directly to CWE-404, which describes improper resource release or reclaim, and aligns with ATT&CK technique T1490 for resource exhaustion attacks that leverage memory leaks. The static analysis tool that identified this issue demonstrates how automated code review can detect subtle kernel-level problems that might otherwise remain hidden during manual code reviews. The fix implementation requires changing the error path in host1x_device_parse_dt() to properly call put_device() instead of direct kfree() operations, ensuring that all device references follow the established kernel device management lifecycle.
The mitigation approach involves modifying the error handling path within host1x_device_add() to ensure that when host1x_device_parse_dt() fails, the embedded device structure receives proper reference release through the device core subsystem. This change maintains consistency with kernel best practices for device management and prevents the accumulation of unreleased references that could lead to system instability or performance degradation. The fix ensures that all device lifecycle events follow the same pattern regardless of success or failure conditions, maintaining proper reference counting throughout the entire operation.
This type of vulnerability represents a common class of issues in kernel development where error paths deviate from normal execution flows without maintaining proper resource management protocols. The embedded device structure's reference counting mechanism is designed to prevent premature deallocation while ensuring proper cleanup when resources are no longer needed. When this mechanism is bypassed through direct memory freeing, it creates opportunities for resource leaks that can compound over time and affect system reliability. The solution reinforces proper kernel programming practices by ensuring all device references follow the established device core lifecycle management rather than relying on direct memory allocation patterns that ignore reference counting requirements.
The fix demonstrates how careful attention to error handling paths can prevent subtle but significant resource management issues in complex kernel subsystems. Device tree parsing operations are particularly prone to such errors because they involve multiple layers of hardware abstraction and require careful error propagation to maintain system stability. The vulnerability highlights the importance of maintaining consistency in kernel resource management patterns, where every reference acquired must have a corresponding release operation regardless of execution path taken. This particular issue underscores how seemingly minor differences in error handling can lead to significant resource leakage problems that affect long-term system health and reliability.