CVE-2026-72406

A flaw was found in the Linux kernel's sungem network driver. During device initialization, if register_netdev() fails, the gem_init_one() function incorrectly calls gem_remove_one(), which frees allocated resources. Subsequently, gem_init_one() proceeds to its own cleanup routine, attempting to free the same resources again. This double-free vulnerability can lead to system instability or a denial of service (DoS).

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires physical access to attach legacy Sun GEM hardware or local administrative privileges to force driver probing, limiting the potential impact to a local denial of service. The affected network driver is intended for specialized hardware and is not enabled by default in standard Red Hat Enterprise Linux distributions. Consequently, typical enterprise installations are not exposed to this issue in default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.