CVE-2026-72269

A flaw was found in the Linux kernel's framebuffer device (fbdev) component, specifically within the uvesafb driver. This vulnerability occurs because memory allocated for display modes is not properly released during certain error handling paths. This oversight can lead to a memory leak, which might exhaust system resources and cause the system to become unresponsive, resulting in a Denial of Service (DoS).

A memory leak was found in the Linux kernel's fbdev uvesafb driver. Due to an incorrect goto label in uvesafb_probe(), memory allocated for the mode database (modedb) and mode list (modelist) in uvesafb_vbe_init() is not freed on some error-handling paths. A local attacker able to trigger such an error path during uvesafb initialization could cause repeated memory leaks, potentially exhausting system resources and leaving the system unresponsive, resulting in a denial of service. Red Hat rates this flaw Moderate impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); it affects only system availability, with no impact on confidentiality or integrity. All currently listed Red Hat product relationships for this flaw, covering the Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel offerings, are marked not affected because the vulnerable code is not present in the shipped kernel packages, so no Red Hat update is required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.