CVE-2026-72485

A flaw was found in the Linux kernel's coresight platform component. The functions responsible for adding input and output connections increment internal counters before successfully allocating memory. If a memory allocation fails, these counters become inconsistent with the actual state of allocated resources. This inconsistency can lead to the system attempting to access uninitialized or invalid memory during error cleanup, causing a system panic and resulting in a Denial of Service (DoS).

This vulnerability is rated as having a Low severity because triggering it requires specific ARM hardware tracing peripherals during device probing under extreme memory allocation failure conditions. The flaw is confined to driver error cleanup routines, which cannot be directly reached by unprivileged local users under normal runtime operations. Furthermore, supported Red Hat Enterprise Linux releases do not include the vulnerable upstream code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.