PT-2026-37447 · Linux · Linux

Published 2026-05-06 · Updated 2026-05-06 · CVE-2025-71272

NVD

In the Linux kernel, the following vulnerability has been resolved:

most: core: fix resource leak in most register interface error paths

The function most register interface() did not correctly release resources if it failed early (before registering the device). In these cases, it returned an error code immediately, leaking the memory allocated for the interface.

Fix this by initializing the device early via device initialize() and calling put device() on all error paths.

The most register interface() is expected to call put device() on error which frees the resources allocated in the caller. The put device() either calls release mdev() or dim2 release(), depending on the caller.

Switch to using device add() instead of device register() to handle the split initialization.

Related Identifiers

CVE-2025-71272

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-71272 · Security Note
• https://git.kernel.org/stable/c/a49028a796d7b94f8e3ab9bd34b18f36be235459 · Note
• https://git.kernel.org/stable/c/1f4c9d8a1021281750c6cda126d6f8a40cc24e71 · Note
• https://git.kernel.org/stable/c/af0b99b2214a10554adb5b868240d23af6e64e71 · Note
• https://git.kernel.org/stable/c/2f483f3817fb0e4209ac5de928778b1da0cc8574 · Note