CVE-2026-72265 Linux CVE debrief

Who should care

Linux system administrators and users of the fbdev: nvidia driver should be aware of this potential memory leak and apply the fix to prevent memory exhaustion. Affected operators include Linux system administrators, platform operators, and security teams. The vulnerability-management impact is moderate, as the fix is relatively straightforward. The security-team impact is low, as the vulnerability is not particularly complex. However, defenders should review the Linux kernel source code and verify system stability after applying the fix to ensure the vulnerability is fully mitigated. They should also monitor system logs for signs of memory leaks and review system stability after applying the fix. Additionally, they should consider implementing compensating controls, such as monitoring and asset inventory, to detect and respond to potential memory leaks. The affected platforms include Linux systems using the fbdev: nvidia driver. The vulnerability-management impact is moderate, as the fix is relatively straightforward. The security-team impact is low, as the vulnerability is not particularly complex. However, defenders should review the Linux kernel source code and verify system stability after applying the fix to ensure the vulnerability is fully mitigated. They should also monitor system logs for signs of memory leaks and review system stability after applying the fix. Additionally, they should consider implementing compensating controls, such as monitoring and asset inventory, to detect and respond to potential memory leaks. The affected platforms include Linux systems using the fbdev: nvidia driver. The vulnerability-management impact is moderate, as the fix is relatively straightforward. The security-team impact is low, as the vulnerability is not particularly complex. However, defenders should review the Linux kernel source code and verify system stability after applying the fix to ensure the vulnerability is fully mitigated. They should also monitor system logs for signs of memory leaks and review system stability after applying the fix. Additionally, they should consider implementing compensating controls, such as monitoring and asset inventory, to detect

Technical summary

The Linux kernel's fbdev: nvidia driver has a potential memory leak in nvidiafb_probe(). The memory allocated for modelist in nvidia_set_fbinfo() is not freed in subsequent error paths. This issue is fixed by calling fb_destroy_modelist(). The affected product is the Linux kernel with the fbdev: nvidia driver. The vulnerability class is a memory leak. The likely operational impact is memory exhaustion, which could lead to system instability or crashes. The source-confidence limits are based on the Linux kernel source code and the CVE record.

Defensive priority

This CVE requires attention due to a potential memory leak in the Linux kernel's fbdev: nvidia driver.

Recommended defensive actions

• Inventory Linux systems using the fbdev: nvidia driver
• Apply the fix by calling fb_destroy_modelist() in error paths
• Monitor for potential memory leaks
• Verify system stability after applying the fix
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Linux kernel's fbdev: nvidia driver has a potential memory leak in nvidiafb_probe(). The memory allocated for modelist in nvidia_set_fbinfo() is not freed in subsequent error paths. Fixing this issue involves calling fb_destroy_modelist(). To verify, defenders should review the Linux kernel source code, specifically the nvidiafb_probe() function, and check for the presence of fb_destroy_modelist() in error paths. Additionally, they should monitor system logs for signs of memory leaks and review system stability after applying the fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.