vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-72171

mtd: slram: remove failed entries from the device list

HIGH
7.8
CVSS Score
Published: August 15, 2026 at 05:53 AM UTC
Updated: August 17, 2026 at 06:18 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list register_device() links a new slram_mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the global list. A later cleanup can then dereference or free invalid state from that failed entry. Unwind the partially initialized entry and clear the list tail on each failure path after the entry has been linked.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
2.6.12 ≤ v < 5.10.2612.6.12 ≤ v < 5.15.2122.6.12 ≤ v < 6.1.1782.6.12 ≤ v < 6.12.972.6.12 ≤ v < 6.18.402.6.12 ≤ v < 6.6.1452.6.12 ≤ v < 7.1.52.6.12 ≤ v < 7.21da177e4c3f41524e886b7f1b8a0c1fc7321cac22.6.12
Vendor states this is fixed in 200b8bc5b6065b02f3775cf131f14b8e1156a00a (fixed)
Vendor states this is fixed in 2fd0cbbb34447ccddab67a2a638a07c6d94cae7a (fixed)
Vendor states this is fixed in 36f1648644d769c496a8e47e53603e863e358d73 (fixed)
Vendor states this is fixed in 9ee674ab10f755bbedbcbb8e76745d2bb8de88d1 (fixed)
Vendor states this is fixed in bdcdfc2464659789032edfad15ff5f7a166f5d7b (fixed)
Vendor states this is fixed in d8dcbbfa0d695a5244059aa34a2e81f3e8df1082 (fixed)
Vendor states this is fixed in e97415b8254d9cc131b7bb1c80fcf38123269b9a (fixed)
Vendor states this is fixed in f40acf577bb0fb0829f285ecfeb27d817840601c (fixed)
Vendor states this is fixed in 2.6.12 (unaffected)
Vendor states this is fixed in 5.10.261 (unaffected)
Vendor states this is fixed in 5.15.212 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.97 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/9ee674ab10f755bbedbcbb8e76745d2bb8de88d1
Source: cverecord
https://git.kernel.org/stable/c/e97415b8254d9cc131b7bb1c80fcf38123269b9a
Source: cverecord
https://git.kernel.org/stable/c/f40acf577bb0fb0829f285ecfeb27d817840601c
Source: cverecord
https://git.kernel.org/stable/c/200b8bc5b6065b02f3775cf131f14b8e1156a00a
Source: cverecord
https://git.kernel.org/stable/c/2fd0cbbb34447ccddab67a2a638a07c6d94cae7a
Source: cverecord
https://git.kernel.org/stable/c/d8dcbbfa0d695a5244059aa34a2e81f3e8df1082
Source: cverecord
https://git.kernel.org/stable/c/bdcdfc2464659789032edfad15ff5f7a166f5d7b
Source: cverecord
https://git.kernel.org/stable/c/36f1648644d769c496a8e47e53603e863e358d73

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card