CVE-2025-71272CWE-401

CVE-2025-71272

Medium · published May 6, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

most: core: fix resource leak in most_register_interface error paths

The function most_register_interface() did not correctly release resources

if it failed early (before registering the device). In these cases, it

returned an error code immediately, leaking the memory allocated for the

interface.

Fix this by initializing the device early via device_initialize() and

calling put_device() on all error paths.

The most_register_interface() is expected to call put_device() on

error which frees the resources allocated in the caller. The

put_device() either calls release_mdev() or dim2_release(),

depending on the caller.

Switch to using device_add() instead of device_register() to handle

the split initialization.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00127 · 2.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-05-06T16:16Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 5.6, < 6.12.756.12.75
linux/linux_kernel≥ 6.13, < 6.18.166.18.16
linux/linux_kernel≥ 6.19, < 6.19.66.19.6
References (5)
EPSS history
Timeline
  • 06 MAY 11:27Z
    most: core: fix resource leak in most_register_interface error paths
    cvelistv5