CVE-2026-72361 Linux CVE debrief

Who should care

Users of the Linux kernel should review their kernel versions and update if necessary to prevent potential denial-of-service or privilege escalation attacks. This vulnerability affects the Linux kernel and could potentially lead to a denial-of-service or privilege escalation. Users should review their kernel versions and update if necessary. Security teams and vulnerability management teams should prioritize this vulnerability and ensure that affected systems are patched or mitigated.

Technical summary

The vulnerability affects the Linux kernel and is related to a double-free of managed BO in the error path of hw_engine_init(). The error path in hw_engine_init() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure. Removing the explicit free allows devm to handle it, consistent with other xe_managed_bo_create_pin_map() callers. This fix prevents a double-free and potential denial-of-service or privilege escalation.

Defensive priority

This vulnerability affects the Linux kernel and could potentially lead to a denial-of-service or privilege escalation. Users should review their kernel versions and update if necessary.

Recommended defensive actions

• Review kernel versions and update if necessary
• Monitor for potential denial-of-service or privilege escalation attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-08-15T06:22:09.530Z. The vulnerability affects the Linux kernel and is related to a double-free of managed BO in the error path of hw_engine_init(). Evidence is limited to public sources and may not be comprehensive. Users should verify their exposure and apply patches or mitigations as necessary. Additional information may be available from official sources such as CVE.org and NVD.

Official resources