CVE-2026-72088 Linux CVE debrief

Who should care

Linux kernel developers and users who rely on the hpsa driver should be aware of this vulnerability and take necessary steps to mitigate its impact. This includes reviewing and applying patches, monitoring system logs, and ensuring that the Linux kernel is up-to-date with the latest security patches. Additionally, system administrators and security teams should review their systems for potential exposure and implement compensating controls as needed.

Technical summary

The Linux kernel's hpsa driver has a DMA mapping leak on the IOACCEL2 reset path. If phys_disk->in_reset is set, the function returns directly without undoing the resources acquired for the command. The issue has been resolved by adding the missing error cleanup. This vulnerability affects Linux kernel developers and users who rely on the hpsa driver. The DMA mapping leak could potentially lead to resource exhaustion or other issues if not properly addressed.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch for the hpsa driver in the Linux kernel
• Monitor system logs for potential issues related to the hpsa driver
• Ensure that the Linux kernel is up-to-date with the latest security patches
• Perform a thorough review of the affected system to identify potential exposure
• Implement compensating controls to mitigate potential impact
• Conduct regular security audits to detect and address vulnerabilities
• Track changes to the Linux kernel and hpsa driver to ensure timely updates and patches

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis is required to fully understand the issue and its potential impact. The Linux kernel's hpsa driver has a DMA mapping leak on the IOACCEL2 reset path. If phys_disk->in_reset is set, the function returns directly without undoing the resources acquired for the command. The issue has been resolved by adding the missing error cleanup. However, the current information available does not provide a comprehensive understanding of the vulnerability's scope, affected systems, or potential mitigations. Additional research and verification are necessary to determine the vulnerability's impact and to develop effective defensive measures.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.