CVE-2026-72167 - Vulnerability Details

- mtd: rawnand: pl353: fix probe resource allocation

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: pl353: fix probe resource allocation

During probe(), the devm_ioremap() is called with the parent device
instead of the current one. So when the module is unloaded, the register
area isn't released.

Target the pl35x device in the devm_ioremap() instead of its parent.

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`08d8c62164a322eb923034acacf25246b775593a`	affected	< 593201a8f43864cb7e25197095f6716a589584fd
`08d8c62164a322eb923034acacf25246b775593a`	affected	< 862c6738833b5b01c801cc47023272f5eaa9a7b2
`08d8c62164a322eb923034acacf25246b775593a`	affected	< afddc648403511b6d2e978e73686c77549bc72b3
`08d8c62164a322eb923034acacf25246b775593a`	affected	< c4c9180b3b23f82e1ec429350b420c45c5b5100e
`08d8c62164a322eb923034acacf25246b775593a`	affected	< ace3a0c839f3bfe1779c6708e7709c824b96dc2f
`08d8c62164a322eb923034acacf25246b775593a`	affected	< 3c44f6c62f652d3ac9d03beb8a199e6388256cdd
`08d8c62164a322eb923034acacf25246b775593a`	affected	< 19ed11aee966d91beebdef9d32ce926474872f79

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[08d8c62164a322eb923034acacf25246b775593a,593201a8f43864cb7e25197095f6716a589584fd)`	affected	code_commit	—
`[08d8c62164a322eb923034acacf25246b775593a,862c6738833b5b01c801cc47023272f5eaa9a7b2)`	affected	code_commit	—
`[08d8c62164a322eb923034acacf25246b775593a,afddc648403511b6d2e978e73686c77549bc72b3)`	affected	code_commit	—
`[08d8c62164a322eb923034acacf25246b775593a,c4c9180b3b23f82e1ec429350b420c45c5b5100e)`	affected	code_commit	—
`[08d8c62164a322eb923034acacf25246b775593a,ace3a0c839f3bfe1779c6708e7709c824b96dc2f)`	affected	code_commit	—
`[08d8c62164a322eb923034acacf25246b775593a,3c44f6c62f652d3ac9d03beb8a199e6388256cdd)`	affected	code_commit	—
`[08d8c62164a322eb923034acacf25246b775593a,19ed11aee966d91beebdef9d32ce926474872f79)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	semver	—
`[0,5.14)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/19ed11aee966d91beebdef9d32ce926474872f79
https://git.kernel.org/stable/c/3c44f6c62f652d3ac9d03beb8a199e6388256cdd
https://git.kernel.org/stable/c/593201a8f43864cb7e25197095f6716a589584fd
https://git.kernel.org/stable/c/862c6738833b5b01c801cc47023272f5eaa9a7b2
https://git.kernel.org/stable/c/ace3a0c839f3bfe1779c6708e7709c824b96dc2f
https://git.kernel.org/stable/c/afddc648403511b6d2e978e73686c77549bc72b3
https://git.kernel.org/stable/c/c4c9180b3b23f82e1ec429350b420c45c5b5100e

History

Sat, 15 Aug 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: pl353: fix probe resource allocation During probe(), the devm_ioremap() is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released. Target the pl35x device in the devm_ioremap() instead of its parent.
Title		mtd: rawnand: pl353: fix probe resource allocation
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/19ed11aee966d91beebdef9d32ce926474872f79 https://git.kernel.org/stable/c/3c44f6c62f652d3ac9d03beb8a199e6388256cdd https://git.kernel.org/stable/c/593201a8f43864cb7e25197095f6716a589584fd https://git.kernel.org/stable/c/862c6738833b5b01c801cc47023272f5eaa9a7b2 https://git.kernel.org/stable/c/ace3a0c839f3bfe1779c6708e7709c824b96dc2f https://git.kernel.org/stable/c/afddc648403511b6d2e978e73686c77549bc72b3 https://git.kernel.org/stable/c/c4c9180b3b23f82e1ec429350b420c45c5b5100e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:53:34.123Z

Updated: 2026-08-15T05:53:34.123Z

Reserved: 2026-08-09T03:40:39.909Z

Link: CVE-2026-72167

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:34.763

Modified: 2026-08-15T06:21:34.763

Link: CVE-2026-72167

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T20:00:08Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object