Strix
56.8K

CVE-2026-72266

UnknownEPSS 0.20%

Last modified

CVE-2026-72266 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: fbdev: vesafb: fix memory leak in vesafb_probe() Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership") the string returned from fb_get_options() is expected to be freed by the caller. But the string is not freed in vesafb_probe(). EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: vesafb: fix memory leak in vesafb_probe() Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership") the string returned from fb_get_options() is expected to be freed by the caller. But the string is not freed in vesafb_probe(). Fix that by freeing the option string after setup.

Metrics

EPSS Probability
0.20%

10.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 73ce73c30ba9ae4d90fdfad7ebe9104001d5d851, < 124df55c7201d011a3fead2205685b6c47eae093; >= 73ce73c30ba9ae4d90fdfad7ebe9104001d5d851, < 43af398217ca8940bf30643fd1150b4c655b8a88; >= 73ce73c30ba9ae4d90fdfad7ebe9104001d5d851, < 58bc18e03481b62f0ec53fe47f36615d52660a7d; >= 73ce73c30ba9ae4d90fdfad7ebe9104001d5d851, < 7b96ce9f8e47538c3c6eebbb217c94d696975cac; >= 73ce73c30ba9ae4d90fdfad7ebe9104001d5d851, < b15d708995c01bbffe7dcd634a31959f6805bed3
LinuxLinux6.4

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72266?
In the Linux kernel, the following vulnerability has been resolved: fbdev: vesafb: fix memory leak in vesafb_probe() Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership") the string returned from fb_get_options() is expected to be freed by the caller. But the string is not freed in vesafb_probe(). Fix that by freeing the option string after setup.
How severe is CVE-2026-72266?
Severity scoring for CVE-2026-72266 is pending analysis. The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72266?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72266?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST