CVE-2026-72240
Description
In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platform_device_register() fails in sm501_register_device(), the embedded struct device in pdev has already been initialized by device_initialize(), but the failure path only reports the error and returns without dropping the device reference for the current platform device: sm501_register_device() -> platform_device_register(pdev) -> device_initialize(&pdev->dev) -> setup_pdev_dma_masks(pdev) -> platform_device_add(pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error. The issue was identified by a static analysis tool I developed and confirmed by manual review.
How to fix
- Linux Linuxbbb1ecaed4ed7680e63d3a0f143f03de32de5d6e, e2dac91380a10e9e8d5883fb73ce9d9b390a629c, 0baf9d43a7b7b43df2900bd8656e75b725028b6e, a3e340d506c1036a747fb0972aebf1063f7ef30e, 760a1029692f1d788dc11aa636a3bf432e58b240, 16a42c88c4667fa0bd944e438a667e059551f1f1, 2ff8156fd500d54c61430b6834137fd0a07047ce, 8c2f0b42fc252e1bf1c7746447091a468e784ca1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | b6d6454fdb66f3829af8b92ab06825b6060fdf7e ≤ v < bbb1ecaed4ed7680e63d3a0f143f03de32de5d6e, b6d6454fdb66f3829af8b92ab06825b6060fdf7e ≤ v < e2dac91380a10e9e8d5883fb73ce9d9b390a629c, b6d6454fdb66f3829af8b92ab06825b6060fdf7e ≤ v < 0baf9d43a7b7b43df2900bd8656e75b725028b6e, b6d6454fdb66f3829af8b92ab06825b6060fdf7e ≤ v < a3e340d506c1036a747fb0972aebf1063f7ef30e, b6d6454fdb66f3829af8b92ab06825b6060fdf7e ≤ v < 760a1029692f1d788dc11aa636a3bf432e58b240, b6d6454fdb66f3829af8b92ab06825b6060fdf7e ≤ v < 16a42c88c4667fa0bd944e438a667e059551f1f1, b6d6454fdb66f3829af8b92ab06825b6060fdf7e ≤ v < 2ff8156fd500d54c61430b6834137fd0a07047ce, b6d6454fdb66f3829af8b92ab06825b6060fdf7e ≤ v < 8c2f0b42fc252e1bf1c7746447091a468e784ca1, 2.6.21 | bbb1ecaed4ed7680e63d3a0f143f03de32de5d6e, e2dac91380a10e9e8d5883fb73ce9d9b390a629c, 0baf9d43a7b7b43df2900bd8656e75b725028b6e, a3e340d506c1036a747fb0972aebf1063f7ef30e, 760a1029692f1d788dc11aa636a3bf432e58b240, 16a42c88c4667fa0bd944e438a667e059551f1f1, 2ff8156fd500d54c61430b6834137fd0a07047ce, 8c2f0b42fc252e1bf1c7746447091a468e784ca1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.