VulnerabilityPublished 15 Aug 2026Updated 6 Nov 2026

CVE-2026-72240: Linux kernel · mfd: sm501: Fix reference leak on failed device registration

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in e2dac91380a10e9e8d5883fb73ce9d9b390a629c : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:19 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in e2dac91380a10e9e8d5883fb73ce9d9b390a629c, bbb1ecaed4ed7680e63d3a0f143f03de32de5d6e, a3e340d506c1036a747fb0972aebf1063f7ef30e +5

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < e2dac91380a10e9e8d5883fb73ce9d9b390a629c	Fixed in e2dac91380a10e9e8d5883fb73ce9d9b390a629c
LinuxLinux	Affected ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < bbb1ecaed4ed7680e63d3a0f143f03de32de5d6e	Fixed in bbb1ecaed4ed7680e63d3a0f143f03de32de5d6e
LinuxLinux	Affected ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < a3e340d506c1036a747fb0972aebf1063f7ef30e	Fixed in a3e340d506c1036a747fb0972aebf1063f7ef30e
LinuxLinux	Affected ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < 760a1029692f1d788dc11aa636a3bf432e58b240	Fixed in 760a1029692f1d788dc11aa636a3bf432e58b240
LinuxLinux	Affected ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < 16a42c88c4667fa0bd944e438a667e059551f1f1	Fixed in 16a42c88c4667fa0bd944e438a667e059551f1f1
LinuxLinux	Affected ≥ b6d6454fdb66f3829af8b92ab06825b6060fdf7e, < 8c2f0b42fc252e1bf1c7746447091a468e784ca1	Fixed in 8c2f0b42fc252e1bf1c7746447091a468e784ca1

Description

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platform_device_register() fails in sm501_register_device(), the embedded struct device in pdev has already been initialized by device_initialize(), but the failure path only reports the error and returns without dropping the device reference for the current platform device: sm501_register_device() -> platform_device_register(pdev) -> device_initialize(&pdev->dev) -> setup_pdev_dma_masks(pdev) -> platform_device_add(pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error. The issue was identified by a static analysis tool I developed and confirmed by manual review.

References

Community reviews

Loading reviews…