CVE-2026-72167 Linux CVE debrief

Who should care

Linux kernel developers, users, and administrators should be aware of this vulnerability and take necessary actions to patch and mitigate potential risks. The vulnerability affects Linux kernel security and requires prompt attention from Linux kernel developers, users, and administrators. They should review and update Linux kernel modules to ensure proper resource deallocation and monitor Linux kernel updates for related security patches. Additionally, Linux kernel developers and users should prioritize patching the rawnand: pl353 probe resource allocation vulnerability to prevent potential security breaches. This vulnerability also affects operators, platforms, vulnerability-management teams, and security teams that rely on the Linux kernel. They should assess their exposure and take necessary actions to mitigate the vulnerability. Furthermore, they should verify the affected scope, severity, and vendor guidance to ensure proper mitigation. Linux kernel developers, users, and administrators should also consider compensating controls for exposed systems while remediation is scheduled and verified. They should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. This will help ensure that the vulnerability is properly mitigated and that the Linux kernel is secure. The vulnerability's impact on Linux kernel security requires a thorough review of the affected systems and prompt action to prevent potential security breaches. Linux kernel developers, users, and administrators should work together to mitigate the vulnerability and ensure the security of the Linux kernel. They should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. This will help ensure that the necessary actions are taken to mitigate the vulnerability and prevent potential security breaches. The vulnerability's significance and potential impact on Linux kernel security necessitate prompt attention and cooperation from Linux kernel developers, users, and administrators. They should prioritize patching

Technical summary

The Linux kernel vulnerability (CVE-2026-72167) is related to the rawnand: pl353 probe resource allocation issue. The problem arises from devm_ioremap() being called with the parent device instead of the current one during probe(), leading to the register area not being released when the module is unloaded. The fix involves targeting the pl35x device in devm_ioremap(). This vulnerability affects Linux kernel developers, users, and administrators, who should prioritize patching the rawnand: pl353 probe resource allocation vulnerability. The vulnerability has significant implications for Linux kernel security and requires immediate attention.

Defensive priority

Linux kernel developers and users should prioritize patching the rawnand: pl353 probe resource allocation vulnerability.

Recommended defensive actions

• Apply the Linux kernel patch for rawnand: pl353 probe resource allocation fix
• Review and update Linux kernel modules to ensure proper resource deallocation
• Monitor Linux kernel updates for related security patches
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The Linux kernel vulnerability (CVE-2026-72167) involves a fix for the pl353 probe resource allocation issue. During probe(), devm_ioremap() was called with the parent device instead of the current one, causing the register area not to be released when the module is unloaded. The fix targets the pl35x device in devm_ioremap(). Evidence is limited to official CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.