CVE-2026-72259 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: mediatek: mt8192: Release reserved memory on cleanup
The MT8192 AFE probe calls of_reserved_mem_device_init() and falls back to preallocated buffers when no reserved memory region is available. When the reserved memory assignment succeeds, however, the driver never releases it.
Register a devm cleanup action after a successful reserved-memory assignment so the assignment is released on probe failure and driver unbind.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's sound subsystem, specifically within the Advanced SoC (ASoC) framework for MediaTek MT8192 audio frontend equipment drivers. This issue represents a memory management flaw that occurs during device initialization and cleanup processes, potentially leading to resource exhaustion and system instability. The problem manifests when the driver attempts to initialize reserved memory regions for audio processing operations but fails to properly release these resources upon failure conditions or driver unbinding events.
The technical flaw stems from improper resource management within the MT8192 AFE driver implementation where of_reserved_mem_device_init() function is invoked during probe operations to establish reserved memory regions for audio data handling. When this initialization succeeds, the driver correctly allocates the required memory resources but neglects to register appropriate cleanup handlers for these allocations. This creates a resource leak scenario where reserved memory segments remain allocated even when the driver fails to complete its initialization properly or when the driver module is unloaded.
The operational impact of this vulnerability extends beyond simple memory consumption issues as it can lead to system-wide resource exhaustion, particularly in embedded systems with limited memory budgets such as mobile devices and IoT platforms. When multiple driver instances fail during probe operations or when drivers are repeatedly loaded and unloaded, the cumulative effect of unreleased reserved memory regions can severely impact system performance and stability. This behavior becomes particularly problematic in environments where audio drivers undergo frequent reinitialization or where automatic driver reloading mechanisms are employed.
The solution involves implementing proper device managed cleanup actions using the devm_ family of functions to ensure that reserved memory allocations are automatically released when appropriate. This approach aligns with established kernel development practices and follows the principle of resource management through automatic cleanup mechanisms. The fix ensures that successful reserved-memory assignments are properly registered for cleanup during driver unbind operations, thereby preventing resource leaks while maintaining proper functionality.
This vulnerability type falls under CWE-404, which specifically addresses improper resource release or cleanup, and relates to the broader category of memory management issues in kernel space. From an ATT&CK perspective, this represents a resource exhaustion technique that could be leveraged by adversaries to degrade system performance or potentially create conditions for more serious exploitation scenarios. The fix demonstrates adherence to kernel security best practices by ensuring proper lifecycle management of device resources and follows the principle of least privilege through careful resource allocation and release mechanisms.
The remediation approach addresses fundamental issues in kernel driver development patterns where automatic cleanup registration is essential for maintaining system stability. By integrating devm_cleanup actions with reserved memory assignments, the driver maintains proper resource accounting throughout its operational lifecycle. This solution pattern is consistent with other kernel subsystems that employ device managed resources to prevent similar classes of vulnerabilities and ensures that system resources are properly accounted for even in failure scenarios. The implementation approach reinforces proper kernel programming practices and helps maintain the overall security posture of Linux-based systems.