CVE-2026-72087 Linux CVE debrief

Who should care

Linux kernel users and administrators, cybersecurity teams, and vulnerability management professionals should be aware of this vulnerability and take necessary actions to prevent potential memory leak exploitation. They should verify Linux kernel version and apply available patches, review system configurations for lpfc_sli4_driver_resource_setup() usage, and monitor system logs for potential memory leak exploitation attempts. Additionally, they should ensure that their systems are up-to-date and consider implementing compensating controls for exposed systems while remediation is scheduled and verified. This includes checking relevant monitoring, detection, and logs for exposed assets that need extra review and tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. Affected product deployments should be identified in managed environments, and an owner should be assigned for follow-up. The official CVE record and NVD detail page should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, remediated assets should be retested, and the item should be closed only after evidence is documented. Asset inventory and source tracking should also be considered to ensure that all necessary actions are taken to prevent potential memory leak exploitation. Rollback/change windows should be considered to minimize potential impact. Linux kernel users should also consider verifying Linux kernel version and applying available patches to prevent potential memory leak exploitation. This includes reviewing system configurations for lpfc_sli4_driver_resource_setup() usage and monitoring system logs for potential memory leak exploitation attempts. Compensating controls should be implemented for exposed systems while remediation is scheduled and verified. This includes checking (

Technical summary

The Linux kernel vulnerability (CVE-2026-72087) is caused by a memory leak in the lpfc_sli4_driver_resource_setup() function. The memory allocated for mboxq using mempool_alloc() is not freed in some early exit error paths, which can lead to memory leaks. A fix has been applied by moving the mempool_free() call to an earlier point after last use. Linux kernel users should review system configurations for lpfc_sli4_driver_resource_setup() usage and monitor system logs for potential memory leak exploitation attempts.

Defensive priority

Linux kernel users should verify and apply available patches to prevent potential memory leak exploitation.

Recommended defensive actions

• Verify Linux kernel version and apply available patches
• Review system configurations for lpfc_sli4_driver_resource_setup() usage
• Monitor system logs for potential memory leak exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The Linux kernel vulnerability (CVE-2026-72087) involves a memory leak in lpfc_sli4_driver_resource_setup(). The memory allocated for mboxq using mempool_alloc() is not freed in some early exit error paths. A fix has been applied by moving the mempool_free() call to an earlier point after last use. Evidence is based on official CVE and NVD records, and Linux kernel source references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.