In the Linux kernel, the following vulnerability has been resolved:
mfd: sm501: Fix reference leak on failed device registration
When platformdeviceregister() fails in sm501registerdevice(), the embedded struct device in pdev has already been initialized by device_initialize(), but the failure path only reports the error and returns without dropping the device reference for the current platform device:
sm501registerdevice() -> platformdeviceregister(pdev) -> deviceinitialize(&pdev->dev) -> setuppdevdmamasks(pdev) -> platformdeviceadd(pdev)
This leads to a reference leak when platformdeviceregister() fails. Fix this by calling platformdeviceput() before returning the error.
The issue was identified by a static analysis tool I developed and confirmed by manual review.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72240.json"
}