CVE-2026-72167

A flaw was found in the mtd: rawnand: pl353 component of the Linux kernel. During the probe function, the devm_ioremap() call incorrectly uses the parent device instead of the pl35x device for resource allocation. This oversight prevents the register area from being properly released when the module is unloaded. A local attacker could potentially exploit this to cause a resource leak, leading to a denial of service (DoS) over time.

A moderate-severity flaw was found in the Linux kernel pl353 raw NAND controller driver (drivers/mtd/nand/raw/pl35x-nand-controller.c). During the driver's probe() routine, devm_ioremap() is called with the parent device instead of the pl35x device, so the mapped controller register area is not released when the module is unloaded. A local attacker able to load and unload the module could exploit this resource leak to cause a denial of service over time; there is no confidentiality or integrity impact. All currently tracked Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) streams are marked not affected because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.