Vulnerability-Lookup

GHSA-RH82-4RXH-756X

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

mtd: slram: remove failed entries from the device list

register_device() links a new slram_mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the global list. A later cleanup can then dereference or free invalid state from that failed entry.

Unwind the partially initialized entry and clear the list tail on each failure path after the entry has been linked.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72171"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:21:35Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: slram: remove failed entries from the device list\n\nregister_device() links a new slram_mtdlist entry before allocating all\nof the state needed by the entry. If a later allocation, memremap(), or\nmtd_device_register() fails, the partially initialized entry remains on\nthe global list. A later cleanup can then dereference or free invalid\nstate from that failed entry.\n\nUnwind the partially initialized entry and clear the list tail on each\nfailure path after the entry has been linked.",
  "id": "GHSA-rh82-4rxh-756x",
  "modified": "2026-08-17T06:33:14Z",
  "published": "2026-08-15T06:32:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72171"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/200b8bc5b6065b02f3775cf131f14b8e1156a00a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2fd0cbbb34447ccddab67a2a638a07c6d94cae7a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/36f1648644d769c496a8e47e53603e863e358d73"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9ee674ab10f755bbedbcbb8e76745d2bb8de88d1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bdcdfc2464659789032edfad15ff5f7a166f5d7b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d8dcbbfa0d695a5244059aa34a2e81f3e8df1082"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e97415b8254d9cc131b7bb1c80fcf38123269b9a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f40acf577bb0fb0829f285ecfeb27d817840601c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-72171 (GCVE-0-2026-72171)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:41

Title

mtd: slram: remove failed entries from the device list

Summary

In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the device list register_device() links a new slram_mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the global list. A later cleanup can then dereference or free invalid state from that failed entry. Unwind the partially initialized entry and clear the list tail on each failure path after the entry has been linked.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

8 references

URL	Tags
https://git.kernel.org/stable/c/9ee674ab10f755bbe…
https://git.kernel.org/stable/c/e97415b8254d9cc13…
https://git.kernel.org/stable/c/f40acf577bb0fb082…
https://git.kernel.org/stable/c/200b8bc5b6065b02f…
https://git.kernel.org/stable/c/2fd0cbbb34447ccdd…
https://git.kernel.org/stable/c/d8dcbbfa0d695a524…
https://git.kernel.org/stable/c/bdcdfc24646597890…
https://git.kernel.org/stable/c/36f1648644d769c49…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9ee674ab10f755bbedbcbb8e76745d2bb8de88d1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e97415b8254d9cc131b7bb1c80fcf38123269b9a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f40acf577bb0fb0829f285ecfeb27d817840601c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 200b8bc5b6065b02f3775cf131f14b8e1156a00a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2fd0cbbb34447ccddab67a2a638a07c6d94cae7a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d8dcbbfa0d695a5244059aa34a2e81f3e8df1082 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bdcdfc2464659789032edfad15ff5f7a166f5d7b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 36f1648644d769c496a8e47e53603e863e358d73 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/devices/slram.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9ee674ab10f755bbedbcbb8e76745d2bb8de88d1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e97415b8254d9cc131b7bb1c80fcf38123269b9a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f40acf577bb0fb0829f285ecfeb27d817840601c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "200b8bc5b6065b02f3775cf131f14b8e1156a00a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2fd0cbbb34447ccddab67a2a638a07c6d94cae7a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d8dcbbfa0d695a5244059aa34a2e81f3e8df1082",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bdcdfc2464659789032edfad15ff5f7a166f5d7b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "36f1648644d769c496a8e47e53603e863e358d73",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/devices/slram.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: slram: remove failed entries from the device list\n\nregister_device() links a new slram_mtdlist entry before allocating all\nof the state needed by the entry. If a later allocation, memremap(), or\nmtd_device_register() fails, the partially initialized entry remains on\nthe global list. A later cleanup can then dereference or free invalid\nstate from that failed entry.\n\nUnwind the partially initialized entry and clear the list tail on each\nfailure path after the entry has been linked."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is only reachable through local module initialization (finit_module/init_module \u2192 init_slram \u2192 parse_cmdline \u2192 register_device) or the slram= boot parameter; there is no network, adjacent-wireless, or physical-device input path to this MTD driver registration code.\nAC:L - An attacker who can load the module controls map parameters and can reliably force register_device() to fail (e.g., memremap on an overlapping/invalid RAM region documented to fail), after which parse_cmdline deterministically calls unregister_devices() on the corrupt list entry.\nPR:L - Exploitation requires loading the slram module via finit_module/init_module, which checks CAP_SYS_MODULE; on kernels allowing unprivileged user namespaces this capability is available to a local unprivileged user, matching CNA guidance for module-init bugs rather than init-namespace root only.\nUI:N - No victim interaction is required; the attacker triggers module load with crafted parameters and the kernel fault occurs automatically on the register_device() failure cleanup path without anyone mounting filesystems or opening devices.\nS:U - Memory corruption occurs entirely within kernel context during module-init teardown of the slram driver; it does not cross VM/hypervisor, IOMMU, or other security boundaries into a separate authority.\nC:H - Failed entries leave NULL or dangling mtdinfo/priv pointers on slram_mtdlist, and unregister_devices() dereferences/frees that invalid state, constituting use-after-free and out-of-bounds kernel memory access that can expose reclaimed heap contents.\nI:H - The mtd_device_register() failure path frees mtdinfo and priv while the list node remains, so unregister_devices() performs double-free and use-after-free on those structures, which is heap corruption exploitable for arbitrary kernel writes and control-flow hijacking.\nA:H - unregister_devices() on a partially initialized entry can NULL-dereference mtdinfo, double-free kmalloc objects, or call mtd_device_unregister/memunmap on invalid pointers, reliably causing kernel oops or panic and repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:09.326Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9ee674ab10f755bbedbcbb8e76745d2bb8de88d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/e97415b8254d9cc131b7bb1c80fcf38123269b9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f40acf577bb0fb0829f285ecfeb27d817840601c"
        },
        {
          "url": "https://git.kernel.org/stable/c/200b8bc5b6065b02f3775cf131f14b8e1156a00a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fd0cbbb34447ccddab67a2a638a07c6d94cae7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8dcbbfa0d695a5244059aa34a2e81f3e8df1082"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdcdfc2464659789032edfad15ff5f7a166f5d7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/36f1648644d769c496a8e47e53603e863e358d73"
        }
      ],
      "title": "mtd: slram: remove failed entries from the device list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72171",
    "datePublished": "2026-08-15T05:53:37.070Z",
    "dateReserved": "2026-08-09T03:40:39.910Z",
    "dateUpdated": "2026-08-17T05:41:09.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-RH82-4RXH-756X

CVE-2026-72171 (GCVE-0-2026-72171)

Tags

Sightings

Nomenclature

Related by attack behaviour