CVE-2026-72214

A flaw was found in the Linux kernel's cpcap-battery driver. This vulnerability occurs because a reference to a non-volatile memory (nvmem) device is not properly released after being acquired. Repeated attempts to read battery properties can exacerbate this issue, leading to a permanent memory leak. This can ultimately result in resource exhaustion, potentially causing system instability or a denial of service.

A moderate severity memory leak was found in the Linux kernel's cpcap-battery power supply driver. In cpcap_battery_detect_battery_type(), the reference to an nvmem device obtained via nvmem_device_find() is not released with nvmem_device_put() on the success or read-failure paths. The driver's retry logic on subsequent battery property reads compounds this leak, so the nvmem device is never freed, which can lead to kernel resource exhaustion and a local denial of service (Red Hat CVSS:3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I/N/A:H). No Red Hat products are affected by this flaw: the vulnerable cpcap-battery driver code is not present in the Red Hat Enterprise Linux (including kernel-rt) and Red Hat In-Vehicle OS kernels shipped for the covered product streams, so exploitation is not possible on Red Hat offerings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.