{"id":"CVE-2026-72223","title":"nvdimm/btt: Free arena sub-allocations on discover_arenas() error path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/btt: Free arena sub-allocations on discover_arenas() error path\n\nMemory allocated by btt_freelist_init(), btt_rtt_init(), and\nbtt_maplocks_init() is not freed on…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 2d0364937550a7b3e2592629c2a68753ac020b28","Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < eeb95774bc79268e2b78ebf01d8781560b5bd671","Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 7563f69caa9143a491d5f26e563255c734751545","Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 0b0d9404951aacc9717aa61e77af4a6e9e8f8249","Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 873ced7f345e99f7ee16f9ff226515580332ecc4","Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 30d490bb2c4cd220e7dedf862ab6a09eb5dcbad5","Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < ba59b96d8d21dc8729fca44a022ca5919c1848c9","Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 13fe4cd9ddd0aacb7777812328be525a11ea3fea","Linux 4.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:52:54.485986Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:22.661Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72223","references":[{"url":"https://git.kernel.org/stable/c/2d0364937550a7b3e2592629c2a68753ac020b28"},{"url":"https://git.kernel.org/stable/c/eeb95774bc79268e2b78ebf01d8781560b5bd671"},{"url":"https://git.kernel.org/stable/c/7563f69caa9143a491d5f26e563255c734751545"},{"url":"https://git.kernel.org/stable/c/0b0d9404951aacc9717aa61e77af4a6e9e8f8249"},{"url":"https://git.kernel.org/stable/c/873ced7f345e99f7ee16f9ff226515580332ecc4"},{"url":"https://git.kernel.org/stable/c/30d490bb2c4cd220e7dedf862ab6a09eb5dcbad5"},{"url":"https://git.kernel.org/stable/c/ba59b96d8d21dc8729fca44a022ca5919c1848c9"},{"url":"https://git.kernel.org/stable/c/13fe4cd9ddd0aacb7777812328be525a11ea3fea"}],"tags":["cve.org"],"epss":0.0022,"epssPercentile":0.12539,"ingestedAt":"2026-11-06T18:00:12.587Z","slug":"CVE-2026-72223","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/btt: Free arena sub-allocations on discover_arenas() error path\n\nMemory allocated by btt_freelist_init(), btt_rtt_init(), and\nbtt_maplocks_init() is not freed on some discover_arenas() error\npaths. This leaks memory when arena discovery fails.\n\nAdd the missing kfree() calls to release the allocations before\nreturning an error.\n\n[ as: commit message and log edits ]\n\n## Affected\n\n- `Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 2d0364937550a7b3e2592629c2a68753ac020b28`\n- `Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < eeb95774bc79268e2b78ebf01d8781560b5bd671`\n- `Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 7563f69caa9143a491d5f26e563255c734751545`\n- `Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 0b0d9404951aacc9717aa61e77af4a6e9e8f8249`\n- `Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 873ced7f345e99f7ee16f9ff226515580332ecc4`\n- `Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 30d490bb2c4cd220e7dedf862ab6a09eb5dcbad5`\n- `Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < ba59b96d8d21dc8729fca44a022ca5919c1848c9`\n- `Linux >= 5212e11fde4d40fa627668b4f2222d20db488f71 < 13fe4cd9ddd0aacb7777812328be525a11ea3fea`\n- `Linux 4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}