CVE-2026-72179riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populate_cache_leaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final of_node_put(np) correctly drops the reference to the current node. However, if the loop terminates naturally because np == NULL, calling of_node_put(np) is a no-op. This leaves the last valid node stored in prev without its reference dropped, resulting in a node reference leak. Fix this by changing the final `of_node_put(np)` to `of_node_put(prev)`.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 94f9bf118f1e294b3f2092f8bde02860f5e3ea3f before 2560c97f63bb99b26d9f19b23a4f66ea24c9dc14; 94f9bf118f1e294b3f2092f8bde02860f5e3ea3f builds before 51afb7da697b698996351740b4f39fb05ce2afd4; from 94f9bf118f1e294b3f2092f8bde02860f5e3ea3f before 880ac50b0bfae06d7ab5f1843253adfb86aa173a; from 94f9bf118f1e294b3f2092f8bde02860f5e3ea3f before f322955d9a1c344ed943752f05aacea7bc22e025; 94f9bf118f1e294b3f2092f8bde02860f5e3ea3f builds before 36e4843fe39ea2f17f4de6d59fba26271916c184; from 94f9bf118f1e294b3f2092f8bde02860f5e3ea3f before bf4a195f063b0a0805c1417f6aad1dd32ea48f0f | CNA record |
References
- https://git.kernel.org/stable/c/2560c97f63bb99b26d9f19b23a4f66ea24c9dc14
- https://git.kernel.org/stable/c/51afb7da697b698996351740b4f39fb05ce2afd4
- https://git.kernel.org/stable/c/880ac50b0bfae06d7ab5f1843253adfb86aa173a
- https://git.kernel.org/stable/c/f322955d9a1c344ed943752f05aacea7bc22e025
- https://git.kernel.org/stable/c/36e4843fe39ea2f17f4de6d59fba26271916c184
- https://git.kernel.org/stable/c/bf4a195f063b0a0805c1417f6aad1dd32ea48f0f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.