{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72406","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.926Z","datePublished":"2026-08-15T05:56:30.225Z","dateUpdated":"2026-08-17T05:43:46.309Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:43:46.309Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sungem: fix probe error cleanup\n\ngem_init_one() calls gem_remove_one() when register_netdev() fails.\ngem_remove_one() unregisters and frees resources owned by the net_device,\nincluding the DMA block, MMIO mapping, PCI regions, and the net_device\nitself. gem_init_one() then falls through to its own cleanup labels and\nfrees the same resources again.\n\nKeep the register_netdev() error path in gem_init_one(): clear drvdata so\nPM/remove paths do not see a half-registered device, remove the NAPI\ninstance added during probe, and let the existing cleanup labels release\nthe resources once.\n\nThe issue was found by a local static-analysis checker for probe error\npaths. The reported path was manually inspected before sending this fix.\n\nCompile-tested with CONFIG_SUNGEM=y. Runtime testing was not performed\nbecause no sungem hardware is available."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in sungem PCI driver probe (gem_init_one) when register_netdev() fails during gem_init_one(); it is reached via local PCI enumeration/module load/hotplug/sysfs bind, not by processing remote network traffic through the NIC.\nAC:L - An attacker can reliably force register_netdev() to fail with ENOMEM using memory exhaustion timed with sungem probe or reprobe (modprobe, PCI hotplug, or sysfs bind); no uncontrollable race or rare heap layout is required beyond attacker-driven pressure.\nPR:L - Only a basic local process is needed to exhaust memory during probe; CAP_SYS_ADMIN/CAP_SYS_MODULE for driver rebind or modprobe is commonly available to maintenance operators, and concurrent unprivileged memory pressure can trigger the failing path without init-namespace root.\nUI:N - No victim interaction (opening files, mounting filesystems, clicking prompts) is required; exploitation is driven by attacker-timed memory pressure during sungem PCI probe error cleanup without actions from other users.\nS:U - The double-free corrupts kernel heap/DMA bookkeeping within the same kernel security domain; it enables local privilege escalation but does not cross VM, container, or IOMMU boundaries on its own.\nC:H - gem_remove_one() followed by fallthrough cleanup double-frees dma_alloc_coherent memory and free_netdev(), and then dereferences freed netdev_priv(gp) in gem_put_cell/iounmap, giving UAF-class heap disclosure primitives.\nI:H - Repeated dma_free_coherent, pci_release_regions, and free_netdev on the same objects corrupts kernel heap/SLUB metadata and can be developed into arbitrary kernel writes or control-flow hijacking, not merely a one-time fault.\nA:H - The double-free and subsequent use-after-free on probe error cleanup can immediately trigger kernel BUG/WARN, oops, or panic, causing total loss of system availability on affected legacy systems using sungem hardware."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/sun/sungem.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f3bd60b26814b7c3c57c629abb0857dfc76d214a","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f1d04fefb0c2a2de32d9cee22cdc2088be3758d1","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"331c99029a1cee1111f82f63d15b3cdebefbd341","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a63eaf7605d1579cf3f551792e478cfaf5ac37d1","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fb73cdc50b6755e5c3a80a195b2708a39ada0230","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b15a3cc68e2450aa0edd94a74a7bdd45fcc17dd9","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bc49e8746584564dba47d963d1916cc876fc6f6b","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"36dea2f639249460d13f6ca66b2a9064187cd34d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/sun/sungem.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f3bd60b26814b7c3c57c629abb0857dfc76d214a"},{"url":"https://git.kernel.org/stable/c/f1d04fefb0c2a2de32d9cee22cdc2088be3758d1"},{"url":"https://git.kernel.org/stable/c/331c99029a1cee1111f82f63d15b3cdebefbd341"},{"url":"https://git.kernel.org/stable/c/a63eaf7605d1579cf3f551792e478cfaf5ac37d1"},{"url":"https://git.kernel.org/stable/c/fb73cdc50b6755e5c3a80a195b2708a39ada0230"},{"url":"https://git.kernel.org/stable/c/b15a3cc68e2450aa0edd94a74a7bdd45fcc17dd9"},{"url":"https://git.kernel.org/stable/c/bc49e8746584564dba47d963d1916cc876fc6f6b"},{"url":"https://git.kernel.org/stable/c/36dea2f639249460d13f6ca66b2a9064187cd34d"}],"title":"net: sungem: fix probe error cleanup","x_generator":{"engine":"bippy-1.2.0"}}}}