CVE-2026-72391

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the Linux kernel when a copper or RollBall SFP module that instantiated an MDIO bus is removed. The function sfp i2c mdiobus create() allocates the I2C MDIO bus using mdio i2c alloc(), but the corresponding sfp i2c mdiobus destroy() function only unregisters the bus and clears the sfp->i2c mii variable without calling mdiobus free(). This results in the struct mii bus being leaked during module hot-removal. The issue is triggered via the sfp sm main() function during the global teardown path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.