CVE-2026-72245

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A device reference leak exists in the host1x device parse dt() error path. In host1x device add(), if host1x device parse dt() fails, the error path uses kfree(device) to free the object directly. This action bypasses the standard device lifetime handling required after device initialize(), which necessitates that the embedded struct device in struct host1x device be released via the device core using the put device() function.

Recommendations Update the Linux kernel to a version where the host1x device parse dt() failure path has been corrected to use put device() instead of kfree().