CVE-2026-72267

A flaw was found in the fbdev: carminefb component of the Linux kernel. This vulnerability arises when memory allocated for the modelist in the fb_videomode_to_modelist() function is not properly deallocated during an error condition. This can lead to a memory leak, potentially impacting system stability or causing a denial of service over time.

A moderate-severity memory leak was found in the Linux kernel fbdev carminefb framebuffer driver. In alloc_carmine_fb(), memory allocated for the modelist by fb_videomode_to_modelist() is not released when a subsequent error path is taken. A local user with low privileges who can repeatedly trigger this failing path could leak kernel memory over time and eventually degrade system availability (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H; no impact to confidentiality or integrity). All currently tracked Red Hat products, including Red Hat Enterprise Linux kernel and kernel-rt streams and Red Hat In-Vehicle OS kernel streams, are not affected by this flaw because the vulnerable carminefb code is not present in the Red Hat kernel packages, so no Red Hat update is required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.