CVE-2026-72240

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference leak occurs in the sm501 register device() function when platform device register() fails. The embedded struct device in pdev is initialized by device initialize(), but the failure path returns an error without dropping the device reference for the current platform device. This sequence involves the following calls: sm501 register device() -> platform device register(pdev) -> device initialize(&pdev->dev) -> setup pdev dma masks(pdev) -> platform device add(pdev).

Recommendations Call platform device put() before returning the error in the sm501 register device() function to ensure the device reference is properly dropped.