CVE-2026-72179 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, RISC-V architecture users, and organizations using Linux-based systems should be aware of this vulnerability and take necessary actions to apply the fix.

Technical summary

The Linux kernel cacheinfo subsystem has a vulnerability that causes a node reference leak in the populate_cache_leaves function for the RISC-V architecture. The issue arises when the loop that populates cache leaves terminates naturally without dropping the reference to the last valid node. The fix involves changing the final of_node_put(np) to of_node_put(prev) to ensure the reference to the previous node is properly dropped.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patch to fix the node reference leak in the populate_cache_leaves function.
• Ensure that the Linux kernel is updated to a version that includes this fix.
• Monitor the Linux kernel for any related security advisories and apply patches as necessary.
• Perform a thorough review of system configurations to ensure that compensating controls are in place for exposed systems.
• Verify that monitoring and detection systems are in place to identify potential security incidents related to this vulnerability.
• Conduct an asset inventory to identify all systems that may be affected by this vulnerability.
• Track changes to the Linux kernel and related security advisories to ensure timely application of future patches.

Evidence notes

The vulnerability is caused by a node reference leak in the populate_cache_leaves function. The loop iterates through nodes and drops the reference to the previous node in each iteration. However, if the loop terminates naturally (i.e., np becomes NULL), the final of_node_put(np) call does not drop the reference to the last valid node stored in prev. This results in a node reference leak. The fix changes the final of_node_put(np) to of_node_put(prev) to address this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.