CVE-2026-72245 (GCVE-0-2026-72245)
Vulnerability from cvelistv5
Published
2026-08-15 05:54
Modified
2026-08-17 05:11
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path After device_initialize(), the embedded struct device in struct host1x_device should be released through the device core with put_device(). In host1x_device_add(), if host1x_device_parse_dt() fails, the current error path frees the object directly with kfree(device). That bypasses the normal device lifetime handling and leaks the reference held on the embedded struct device. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device() in the host1x_device_parse_dt() failure path.
References
Impacted products
Vendor Product Version
Linux Linux Version: f4c5cf88fbd50e4779042268947b2e2f90c20484
Version: f4c5cf88fbd50e4779042268947b2e2f90c20484
Version: f4c5cf88fbd50e4779042268947b2e2f90c20484
Version: f4c5cf88fbd50e4779042268947b2e2f90c20484
Version: f4c5cf88fbd50e4779042268947b2e2f90c20484
Version: f4c5cf88fbd50e4779042268947b2e2f90c20484
Version: f4c5cf88fbd50e4779042268947b2e2f90c20484
Version: f4c5cf88fbd50e4779042268947b2e2f90c20484
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/host1x/bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a408d89e20d38d78f540e1951dc4c6056ad662e1",
              "status": "affected",
              "version": "f4c5cf88fbd50e4779042268947b2e2f90c20484",
              "versionType": "git"
            },
            {
              "lessThan": "4ee41361c637eafa80f5d88b46d0016e6cdb24db",
              "status": "affected",
              "version": "f4c5cf88fbd50e4779042268947b2e2f90c20484",
              "versionType": "git"
            },
            {
              "lessThan": "3642d0a45214e3b4cf61bf5e75b04b490d0b3519",
              "status": "affected",
              "version": "f4c5cf88fbd50e4779042268947b2e2f90c20484",
              "versionType": "git"
            },
            {
              "lessThan": "edc7267b59a465c6ae7c5ffac2171c30962bd325",
              "status": "affected",
              "version": "f4c5cf88fbd50e4779042268947b2e2f90c20484",
              "versionType": "git"
            },
            {
              "lessThan": "4454caa204a2edb19c62754ddb96e5dbca0d2f49",
              "status": "affected",
              "version": "f4c5cf88fbd50e4779042268947b2e2f90c20484",
              "versionType": "git"
            },
            {
              "lessThan": "c4d6442ac3ed00041fe4e1df715717ed78a7d37f",
              "status": "affected",
              "version": "f4c5cf88fbd50e4779042268947b2e2f90c20484",
              "versionType": "git"
            },
            {
              "lessThan": "8559b1501f77a5b5d003790bec170ca449e0c674",
              "status": "affected",
              "version": "f4c5cf88fbd50e4779042268947b2e2f90c20484",
              "versionType": "git"
            },
            {
              "lessThan": "e75717f9aec04355777be41070890c6a815c76df",
              "status": "affected",
              "version": "f4c5cf88fbd50e4779042268947b2e2f90c20484",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/host1x/bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path\n\nAfter device_initialize(), the embedded struct device in struct\nhost1x_device should be released through the device core with\nput_device().\n\nIn host1x_device_add(), if host1x_device_parse_dt() fails, the current\nerror path frees the object directly with kfree(device). That bypasses\nthe normal device lifetime handling and leaks the reference held on the\nembedded struct device.\n\nThe issue was identified by a static analysis tool I developed and\nconfirmed by manual review.\n\nFix this by using put_device() in the host1x_device_parse_dt() failure\npath."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:11:03.666Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a408d89e20d38d78f540e1951dc4c6056ad662e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ee41361c637eafa80f5d88b46d0016e6cdb24db"
        },
        {
          "url": "https://git.kernel.org/stable/c/3642d0a45214e3b4cf61bf5e75b04b490d0b3519"
        },
        {
          "url": "https://git.kernel.org/stable/c/edc7267b59a465c6ae7c5ffac2171c30962bd325"
        },
        {
          "url": "https://git.kernel.org/stable/c/4454caa204a2edb19c62754ddb96e5dbca0d2f49"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4d6442ac3ed00041fe4e1df715717ed78a7d37f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8559b1501f77a5b5d003790bec170ca449e0c674"
        },
        {
          "url": "https://git.kernel.org/stable/c/e75717f9aec04355777be41070890c6a815c76df"
        }
      ],
      "title": "gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72245",
    "datePublished": "2026-08-15T05:54:32.611Z",
    "dateReserved": "2026-08-09T03:40:39.914Z",
    "dateUpdated": "2026-08-17T05:11:03.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.