CVE-2026-72265

A flaw was found in the Linux kernel's NVIDIA framebuffer driver. During the initialization process within the nvidiafb_probe() function, if certain error conditions occur, memory allocated for internal data structures is not properly released. This can lead to a memory leak, potentially affecting system stability and performance over extended periods.

A low-impact memory leak was found in the Linux kernel's NVIDIA framebuffer (nvidiafb) driver. When nvidiafb_probe() fails on an error path after nvidia_set_fbinfo() has allocated the framebuffer mode list, that memory is not released, resulting in a small kernel memory leak per failed probe attempt. Triggering the flaw requires local access with privileges sufficient to influence driver loading, device binding, or PCI framebuffer probe conditions, and the consequence is limited to memory exhaustion (denial of service) after repeated failed probes; confidentiality and integrity are not affected. Red Hat Product Security rates this flaw Low impact because the leak occurs only on driver probe error paths, reliable triggering requires local privileged access, and no information disclosure or arbitrary-write primitive is exposed; this is a lower severity than the CVSS 3.1 base score of 5.5 (Moderate), which reflects the worst-case availability impact. Red Hat Enterprise Linux 8 kernel and kernel-rt are affected; the fix is deferred for the affected RHEL 8 update streams because this is a low-severity resource leak on an error path with no direct security consequence, and the residual risk is limited to gradual memory consumption on systems that repeatedly trigger failed nvidiafb probes. Other Red Hat products, including Red Hat Enterprise Linux 6, 7, 9, and 10 and Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in their kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.