CVE-2026-72138

A flaw was found in the xen/gntdev component of the Linux kernel. When the gntdev_ioctl_map_grant_ref() function fails to copy operation results back to userspace, it does not properly release a memory reference. This oversight can lead to a memory leak and a corrupted list entry. A local attacker could exploit this to cause a denial of service by exhausting system memory.

A flaw of Moderate impact was found in the xen/gntdev driver of the Linux kernel. When gntdev_ioctl_map_grant_ref() fails to copy the operation result back to userspace after a grant mapping has been added to the per-file list, the error path returns -EFAULT without releasing the reference acquired by gntdev_alloc_map(). The mapping remains in the list with its reference held, leaking kernel memory and leaving a stale list entry. A local attacker with access to the Xen grant-table device could repeatedly trigger this failing path to exhaust kernel memory and cause a denial of service. Red Hat rated this flaw Moderate severity with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux (kernel, kernel-rt) and Red Hat In-Vehicle OS (kernel, kernel-ivos-qualcomm) are not affected by this flaw because the vulnerable code is not present in the shipped builds of these products, so no update is required for them.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.