The Linux kernel vulnerability CVE-2026-72026 involves a memory leak in the irqchip/irq-riscv-imsic-early code path. Specifically, the function imsic_early_acpi_init() allocates a firmware node before setting up the IMSIC state. If the imsic_setup_state() call fails, the allocated fwnode was not freed, causing a resource leak. The fix introduces proper cleanup of the fwnode and resets the global pointer on error paths, using a common cleanup routine to prevent this leak.

The vulnerability results in a firmware node memory leak on state setup failure in the Linux kernel. While this does not directly lead to code execution or privilege escalation, it can cause resource exhaustion or instability over time if the error condition is repeatedly triggered.

A fix has been implemented in the Linux kernel to address this issue by properly freeing the allocated firmware node on error paths. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel release notes for the specific patch version and update accordingly.