CVE-2026-72171 mtd: slram: remove failed entries from the device list
A flaw in the Linux kernel's slram driver allows a local attacker to cause a denial of service by triggering a null pointer dereference during device registration failures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72171?
CVE-2026-72171 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mtd: slram: remove failed entries from the device list
register_device() links a new slram_mtdlist entry before allocating all of the state needed by the entry. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the global list. A later cleanup can then dereference or free invalid state from that failed entry.
Unwind the partially initialized entry and clear the list tail on each failure path after the entry has been linked.
Which versions are affected by CVE-2026-72171?
How do I fix CVE-2026-72171?
Apply the vendor's patch.
Is CVE-2026-72171 being exploited?
There is no known exploitation of CVE-2026-72171 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72171, DEBIAN-CVE-2026-72171, GHSA-rh82-4rxh-756x, UBUNTU-CVE-2026-72171.