In the Linux kernel, the following vulnerability has been resolved:
gpu: host1x: Fix device reference leak in host1xdeviceparse_dt() error path
After deviceinitialize(), the embedded struct device in struct host1xdevice should be released through the device core with put_device().
In host1xdeviceadd(), if host1xdeviceparse_dt() fails, the current error path frees the object directly with kfree(device). That bypasses the normal device lifetime handling and leaks the reference held on the embedded struct device.
The issue was identified by a static analysis tool I developed and confirmed by manual review.
Fix this by using putdevice() in the host1xdeviceparsedt() failure path.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72245.json"
}