CyberSecBulletin
CVE-2026-72005NVD status: Received

Linux: Improper Resource Shutdown or Release

Published Updated By the CyberSecBulletin desk

CVE-2026-72005 is a high-severity improper resource shutdown or release vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 8b58d1f1356df6a7d2de3f55bb665b18b04ffda0, 59afe6148927395cf86f9429900e029a48b1d42b, 3c0427d719bddb33caf18ff4ffb77cb47de7eb00 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 8b58d1f1356df6a7d2de3f55bb665b18b04ffda0 or 59afe6148927395cf86f9429900e029a48b1d42b or 3c0427d719bddb33caf18ff4ffb77cb47de7eb00 or eb7474d0253bb2de4793e1d3ce833e8564bbe732, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 up to, but not including, 8b58d1f1356df6a7d2de3f55bb665b18b04ffda0; 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 up to, but not including, 59afe6148927395cf86f9429900e029a48b1d42b; 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 up to, but not including, 3c0427d719bddb33caf18ff4ffb77cb47de7eb00; 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 up to, but not including, eb7474d0253bb2de4793e1d3ce833e8564bbe732; 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 up to, but not including, 66bd9b1a72de7c2f5141b02d796048aafaed8a49; 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 up to, but not including, 816559409e340acaa5c9d868291dab30d8c80263; 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 up to, but not including, 56994852d704535ea354a4627ca667b1b4fa0deb; 0439f5367c8d8bb2ebaca8d7329f51f3148b2fb2 up to, but not including, 536fb3d739d75a03cb318c0c6fe799425cfea501; and 1 more ranges8b58d1f1356df6a7d2de3f55bb665b18b04ffda0, 59afe6148927395cf86f9429900e029a48b1d42b, 3c0427d719bddb33caf18ff4ffb77cb47de7eb00, eb7474d0253bb2de4793e1d3ce833e8564bbe732, 66bd9b1a72de7c2f5141b02d796048aafaed8a49, 816559409e340acaa5c9d868291dab30d8c80263

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for all probe failures. However, drv_data allocation and workqueue allocation can fail before intf_work, autowakeup_work and sleep_work have been initialized. Do not enter the full remove path until the probe has reached the point where those work items are set up. Return directly for drv_data allocation failure, and use a small early cleanup path for workqueue allocation failure. This issue was found by our static analysis tool and then confirmed by manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The early probe exits should not call a common teardown path that assumes the later work setup has already completed. A QEMU PoC forced alloc_ordered_workqueue() to fail before the work initializers are reached. The resulting fail path entered rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
  • It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
  • Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].

More Improper Resource Shutdown or Release vulnerabilities (CWE-404)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Resource Shutdown or Release vulnerabilities

Spotted an error? Tell us.