CVE-2026-72270

A flaw was found in the Linux kernel's s3fb driver, which handles S3 graphics cards. This vulnerability involves a memory leak within the s3_pci_probe() function. When certain error conditions occur, memory allocated for display mode lists is not properly freed. This oversight could allow an attacker to gradually consume system memory, potentially leading to a denial of service (DoS) by making the system unstable or unresponsive.

This vulnerability is rated Moderate due to its local attack scope and the requirement for specific legacy graphics hardware to trigger the leak. The affected fbdev driver for S3 adapters is not enabled by default in standard Red Hat Enterprise Linux kernel configurations, significantly limiting exposure in typical production environments. Exploitation requires physical or emulated access to an S3 PCI device and repeated initialization failures to cause a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.