CVE-2026-72224 - Vulnerability Details

- nvdimm/btt: Free arenas on btt_init() error paths

Description

In the Linux kernel, the following vulnerability has been resolved:

nvdimm/btt: Free arenas on btt_init() error paths

The arenas allocated by discover_arenas() or create_arenas() are not
freed on some error paths in btt_init(). This leaks memory when BTT
initialization fails.

Call free_arenas() from the affected error paths to release the
allocations.

[ as: commit message and log edits ]

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5212e11fde4d40fa627668b4f2222d20db488f71`	affected	< 9ab5293d9ac3f2c4232220e563d04701f5f44607
`5212e11fde4d40fa627668b4f2222d20db488f71`	affected	< 68c967e105d50f885e02b0dbdc9211fd5f84bdcd
`5212e11fde4d40fa627668b4f2222d20db488f71`	affected	< 0b63788093ff6ccfffe6e87de9e08aeeb406599c
`5212e11fde4d40fa627668b4f2222d20db488f71`	affected	< 5804e6a6912b5a1e47c821777d69191d69a3fe64
`5212e11fde4d40fa627668b4f2222d20db488f71`	affected	< 52a7e7ece79c4b0f406149e19cd2b4b11a6c19e4
`5212e11fde4d40fa627668b4f2222d20db488f71`	affected	< f4ca396bdd60b4e0a665b2589bfc4ddbea9bda2b
`5212e11fde4d40fa627668b4f2222d20db488f71`	affected	< 7e49684d90faa34ff6d5586be658e986d9d475ac
`5212e11fde4d40fa627668b4f2222d20db488f71`	affected	< 1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5212e11fde4d40fa627668b4f2222d20db488f71,9ab5293d9ac3f2c4232220e563d04701f5f44607)`	affected	code_commit	—
`[5212e11fde4d40fa627668b4f2222d20db488f71,68c967e105d50f885e02b0dbdc9211fd5f84bdcd)`	affected	code_commit	—
`[5212e11fde4d40fa627668b4f2222d20db488f71,0b63788093ff6ccfffe6e87de9e08aeeb406599c)`	affected	code_commit	—
`[5212e11fde4d40fa627668b4f2222d20db488f71,5804e6a6912b5a1e47c821777d69191d69a3fe64)`	affected	code_commit	—
`[5212e11fde4d40fa627668b4f2222d20db488f71,52a7e7ece79c4b0f406149e19cd2b4b11a6c19e4)`	affected	code_commit	—
`[5212e11fde4d40fa627668b4f2222d20db488f71,f4ca396bdd60b4e0a665b2589bfc4ddbea9bda2b)`	affected	code_commit	—
`[5212e11fde4d40fa627668b4f2223d20db488f71,7e49684d90faa34ff6d5586be658e986d9d475ac)`	affected	code_commit	—
`[5212e11fde4d40fa627668b4f2222d20db488f71,1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b63788093ff6ccfffe6e87de9e08aeeb406599c
https://git.kernel.org/stable/c/1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57
https://git.kernel.org/stable/c/52a7e7ece79c4b0f406149e19cd2b4b11a6c19e4
https://git.kernel.org/stable/c/5804e6a6912b5a1e47c821777d69191d69a3fe64
https://git.kernel.org/stable/c/68c967e105d50f885e02b0dbdc9211fd5f84bdcd
https://git.kernel.org/stable/c/7e49684d90faa34ff6d5586be658e986d9d475ac
https://git.kernel.org/stable/c/9ab5293d9ac3f2c4232220e563d04701f5f44607
https://git.kernel.org/stable/c/f4ca396bdd60b4e0a665b2589bfc4ddbea9bda2b

History

Sat, 15 Aug 2026 20:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on btt_init() error paths The arenas allocated by discover_arenas() or create_arenas() are not freed on some error paths in btt_init(). This leaks memory when BTT initialization fails. Call free_arenas() from the affected error paths to release the allocations. [ as: commit message and log edits ]
Title		nvdimm/btt: Free arenas on btt_init() error paths
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b63788093ff6ccfffe6e87de9e08aeeb406599c https://git.kernel.org/stable/c/1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57 https://git.kernel.org/stable/c/52a7e7ece79c4b0f406149e19cd2b4b11a6c19e4 https://git.kernel.org/stable/c/5804e6a6912b5a1e47c821777d69191d69a3fe64 https://git.kernel.org/stable/c/68c967e105d50f885e02b0dbdc9211fd5f84bdcd https://git.kernel.org/stable/c/7e49684d90faa34ff6d5586be658e986d9d475ac https://git.kernel.org/stable/c/9ab5293d9ac3f2c4232220e563d04701f5f44607 https://git.kernel.org/stable/c/f4ca396bdd60b4e0a665b2589bfc4ddbea9bda2b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:54:16.781Z

Updated: 2026-08-15T05:54:16.781Z

Reserved: 2026-08-09T03:40:39.913Z

Link: CVE-2026-72224

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:41.370

Modified: 2026-08-15T06:21:41.370

Link: CVE-2026-72224

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T20:30:14Z

Weaknesses

CWE-401
Missing Release of Memory after Effective Lifetime

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object