CVE-2026-72179

A flaw was found in the Linux kernel's handling of cache information. This vulnerability occurs when the system fails to properly release memory references during certain operations. This oversight results in a memory leak, which can lead to resource exhaustion and potentially impact system stability.

A flaw was found in the Linux kernel's RISC-V cache information handling, rated MODERATE severity by Red Hat with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). In populate_cache_leaves(), the device node traversal loop drops the reference to the previous node on each iteration; however, when the loop terminates naturally because the current node pointer is NULL, the final of_node_put() call becomes a no-op, leaving the last valid node's reference undropped. This node reference leak results in a kernel memory leak, which could allow a local user on an affected system to progressively exhaust memory resources and degrade system availability. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw, because the vulnerable code is not present in the shipped kernel packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.