CVE-2026-72050 octeontx2-af: Free BPID bitmap on setup failure
A memory leak in the Linux kernel octeontx2-af driver allows local attackers to cause denial of service by triggering setup failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72050?
CVE-2026-72050 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: Free BPID bitmap on setup failure
nix_setup_bpids() allocates bp->bpids with rvu_alloc_bitmap(), which uses a plain kcalloc(). If any of the following devm_kcalloc() allocations for the BPID mapping arrays fails, the function returns without freeing the bitmap. Free the BPID bitmap before returning from those error paths.
Which versions are affected by CVE-2026-72050?
How do I fix CVE-2026-72050?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72050 being exploited?
There is no known exploitation of CVE-2026-72050 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72050, DEBIAN-CVE-2026-72050, GHSA-8jpf-cw7w-fxjf, UBUNTU-CVE-2026-72050.