CVE-2026-72276

A flaw was found in the metronomefb framebuffer driver within the Linux kernel. This vulnerability occurs because memory allocated for page references is not properly released when an error occurs during initialization. A local attacker could potentially exploit this to cause a denial of service due to excessive memory consumption.

A low-impact flaw was found in the metronomefb framebuffer driver in the Linux kernel. When an error occurs during metronomefb_probe() after fb_deferred_io_init() has allocated memory for deferred-I/O page references, that memory is not released because fb_deferred_io_cleanup() is not called on the error path. A local attacker able to trigger repeated failed probe attempts of a metronomefb device could exploit this flaw to consume excessive memory and cause a denial of service; there is no impact on confidentiality or integrity. Red Hat rates the impact of this flaw as Low because exploitation requires local access and the ability to reach the driver's initialization error path, and the consequence is limited to memory exhaustion. All currently tracked Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel, kernel-rt, and related streams are marked not affected for this flaw because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.