CVE-2026-72259 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators who use the ASoC: mediatek component. They should verify the Linux kernel version and update if necessary. They should also monitor the system for potential memory leaks and review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The MT8192 AFE probe calls of_reserved_mem_device_init() and falls back to preallocated buffers when no reserved memory region is available. However, when the reserved memory assignment succeeds, the driver never releases it. A devm cleanup action is needed to release the reserved memory on probe failure and driver unbind. The vulnerability affects the ASoC: mediatek component in the Linux kernel.

Defensive priority

Medium priority for Linux kernel maintainers and users, as it requires a fix to prevent potential memory leaks.

Recommended defensive actions

• Review and apply the provided patches to fix the vulnerability
• Verify the Linux kernel version and update if necessary
• Monitor the system for potential memory leaks
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The source item provides details about the CVE record from the NVD. However, the information is limited, and further verification is needed to confirm the vulnerability's impact and affected systems. The Linux kernel maintainers and users should verify the Linux kernel version and update if necessary. The vulnerability affects the ASoC: mediatek component, and the MT8192 AFE probe assigns reserved memory but fails to release it when the reserved memory assignment succeeds. A devm cleanup action is needed to release the reserved memory on probe failure and driver unbind. The vulnerability has a medium priority for Linux kernel maintainers and users, as it requires a fix to prevent potential memory leaks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.