CVE-2026-72168

A flaw was found in the Linux kernel's Memory Technology Device (MTD) subsystem, specifically within the vmu-flash driver. This vulnerability arises from incorrect memory allocation, where kmalloc_obj() was used instead of kzalloc_obj() for memcard structures. This can lead to access of uninitialized data, resulting in a runtime error and potentially a denial of service (DoS) for the system.

Moderate impact is assigned because uninitialized memory access within this driver could result in a local denial of service via a kernel crash, rather than enabling remote exploitation or privilege escalation. Furthermore, triggering the condition requires physical or emulated access to specialized Sega Dreamcast Visual Memory Unit hardware. Red Hat Enterprise Linux kernels do not compile or ship this architecture-specific driver, leaving default installations unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.