CVE-2026-72275 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the linux kernel's framebuffer subsystem specifically affecting the broadsheetfb driver implementation. This issue represents a classic memory management flaw that occurs during device probe operations when the driver fails to properly clean up allocated resources. The problem manifests in the broadsheetfb_probe() function where memory allocation for pagerefs structures through fb_deferred_io_init() routine creates a potential memory leak scenario. When error conditions occur during the probe process, the allocated memory remains unreleased, leading to gradual resource exhaustion over time.
The technical flaw stems from improper error handling within the driver's initialization sequence. During normal operation, fb_deferred_io_init() allocates memory structures necessary for deferred io operations and pagerefs management. However, when subsequent validation checks or hardware initialization steps fail, the code path does not execute the cleanup routine fb_deferred_io_cleanup(). This oversight creates a resource leak pattern that aligns with CWE-401 weakness classification for improper resource release or cleanup. The memory allocated for page reference tracking structures becomes permanently unavailable to the system, potentially leading to system instability or performance degradation.
The operational impact of this vulnerability extends beyond simple memory waste, as it can contribute to broader system reliability issues in embedded environments where framebuffer devices are commonly deployed. Systems utilizing broadsheetfb drivers for display output may experience progressive memory consumption that eventually leads to system slowdowns or crashes when memory pressure increases. This is particularly concerning in resource-constrained embedded systems or automotive applications where such drivers might be utilized for instrument clusters or infotainment displays. The vulnerability affects any kernel version where the problematic code path exists, making it a persistent risk across multiple release cycles.
Mitigation strategies should focus on implementing proper error handling patterns that ensure cleanup routines execute regardless of success or failure conditions. The recommended fix involves integrating fb_deferred_io_cleanup() calls into all error paths within broadsheetfb_probe(), ensuring that allocated resources are properly released even when initialization fails. This approach aligns with ATT&CK technique T1484 which addresses privilege escalation through resource exhaustion attacks, though in this case the impact stems from improper cleanup rather than malicious exploitation. System administrators should prioritize kernel updates to versions containing the specific patch addressing this memory leak, while also implementing monitoring for abnormal memory usage patterns that might indicate resource exhaustion from similar issues. The fix demonstrates proper defensive programming practices and emphasizes the importance of resource management in kernel-level drivers where memory leaks can have cascading effects on overall system stability.