CVE-2026-72168 mtd: maps: vmu-flash: fix fault in unaligned fixup
A local attacker can trigger a kernel fault and potentially read uninitialized memory in the vmu-flash driver due to improper allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72168?
CVE-2026-72168 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mtd: maps: vmu-flash: fix fault in unaligned fixup
Use kzalloc_obj() / kzalloc_objs() to allocate the memcard structs, instead of kmalloc_obj() / kmalloc_objs() to prevent access to uninitialized data.
Fixes runtime error: Fault in unaligned fixup: 0000 [#1] at mtd_get_fact_prot_info.
Which versions are affected by CVE-2026-72168?
How do I fix CVE-2026-72168?
Apply the vendor's patch.
Is CVE-2026-72168 being exploited?
There is no known exploitation of CVE-2026-72168 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72168, DEBIAN-CVE-2026-72168, GHSA-24w7-qc46-mvh6, UBUNTU-CVE-2026-72168.