CVE-2026-72268

A flaw was found in the Linux kernel's tdfxfb driver. Specifically, the tdfxfb_probe() function, when the CONFIG_FB_3DFX_I2C option is enabled, does not properly free memory allocated for the modelist in certain error handling paths. This oversight can lead to a memory leak, which a local attacker could potentially exploit to cause a Denial of Service (DoS) by exhausting system memory.

A Moderate-impact memory leak flaw was found in the Linux kernel's tdfxfb framebuffer driver. When the kernel is built with the CONFIG_FB_3DFX_I2C option enabled, tdfxfb_probe() allocates memory for the video mode list via fb_videomode_to_modelist(), but this memory is not freed when the function later takes an error path. A local attacker able to trigger repeated probe failures of this driver could use this flaw to exhaust kernel memory and cause a denial of service. Red Hat rated this flaw with a CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) streams have been assessed as not affected because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.