CVE-2026-72391 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems, especially those using copper/RollBall SFP modules, should review and apply the kernel patch to prevent potential memory leaks. They should also monitor Linux kernel updates for related security patches and perform regular vulnerability scans and inventory checks to identify affected systems. System administrators and security teams responsible for Linux-based infrastructure are also advised to take note of this vulnerability and plan for mitigation efforts as necessary. Additionally, organizations relying on Linux kernel for their operations should ensure that their systems are updated with the latest security patches to minimize exposure to potential threats. Security researchers and auditors may also be interested in the technical details of this vulnerability for risk assessment and penetration testing purposes. Lastly, Linux kernel contributors and reviewers should verify the fix and consider adding additional tests to prevent similar issues in the future. The vulnerability highlights the importance of thorough memory management in kernel development and the need for ongoing review and testing of kernel code changes. Therefore, a broad range of stakeholders across the Linux ecosystem should be aware of this issue and take appropriate actions to mitigate potential risks. This includes reviewing code changes, applying patches, and monitoring system behavior for anomalies that could indicate exploitation attempts. By taking these steps, stakeholders can help ensure the security and stability of Linux-based systems. The vulnerability also underscores the value of community involvement in the Linux kernel development process, as contributors from various backgrounds help identify and address potential security issues. Overall, awareness and proactive management of this vulnerability are crucial for maintaining the security posture of Linux-based environments. Linux users and administrators should stay informed about kernel updates and security advisories to ensure their systems remain protected against known vulnerabilities like this one. The issue demonstrates

Technical summary

The Linux kernel vulnerability involves a memory leak in the sfp_i2c_mdiobus_destroy function. The function allocates an I2C MDIO bus using mdio_i2c_alloc() but only unregisters the bus without freeing it, leading to a potential memory leak when a copper/RollBall SFP module is removed. This issue is triggered on module hot-removal, not on unbind. The fix involves freeing the mii_bus in sfp_i2c_mdiobus_destroy to match the allocation done in sfp_i2c_mdiobus_create.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel patch to ensure the mii_bus is properly freed in sfp_i2c_mdiobus_destroy.
• Monitor Linux kernel updates for related security patches.
• Perform regular vulnerability scans and inventory checks to identify affected systems.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The Linux kernel vulnerability involves a memory leak in the sfp_i2c_mdiobus_destroy function. The function allocates an I2C MDIO bus using mdio_i2c_alloc() but only unregisters the bus without freeing it, leading to a potential memory leak when a copper/RollBall SFP module is removed. Evidence is limited to the supplied CVE record and NVD details. Defenders should verify the kernel patch and review system logs for related issues.

Official resources