CVE-2026-72406 Linux CVE debrief

Who should care

Linux kernel developers and users who rely on the sungem driver should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying the provided patch, ensuring that the Linux kernel is updated with the latest security patches, and monitoring for any potential exploits or attacks targeting this vulnerability.

Technical summary

The Linux kernel's sungem driver has a vulnerability that occurs when the probe function fails during registration of the network device. The error path in the probe function calls gem_remove_one(), which unregisters and frees resources owned by the net_device. However, the probe function then falls through to its own cleanup labels and frees the same resources again, leading to double-free errors. To fix this issue, the probe function should clear drvdata so PM/remove paths do not see a half-registered device, remove the NAPI instance added during probe, and let the existing cleanup labels release the resources once.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patch to fix the double-free error in the sungem driver.
• Ensure that the Linux kernel is updated with the latest security patches.
• Monitor for any potential exploits or attacks targeting this vulnerability.
• Perform a thorough review of the system configuration to identify potential vulnerabilities.
• Implement additional monitoring to detect potential attacks.
• Verify that the patch is applied correctly and that the system is not vulnerable to attacks.
• Conduct a thorough risk assessment to identify potential impacts of the vulnerability.

Evidence notes

The issue was found by a local static-analysis checker for probe error paths. The reported path was manually inspected before sending this fix. Compile-tested with CONFIG_SUNGEM=y. Runtime testing was not performed because no sungem hardware is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.