{"cve":"CVE-2026-72058","nvd":{"published":"2026-08-15T06:21:15.260","modified":"2026-08-23T13:16:38.720","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ixp4xx_hss: fix duplicate HDLC netdev allocation\n\nixp4xx_hss_probe() allocates two HDLC netdevs. The first one is stored\nin ndev, initialized, and registered with register_hdlc_device(). The\nsecond one is stored in port->netdev and later used by the remove path\nfor unregister_hdlc_device() and free_netdev().\n\nThis means that the registered netdev is not the same object that is\nunregistered and freed on remove. It also leaks the first allocation if\nthe second alloc_hdlcdev() call fails, and the first allocation is not\nchecked before ndev is used.\n\nOlder code allocated the HDLC netdev only once and stored the same object\nin both the local variable and port->netdev. The buggy conversion split\nthis into two alloc_hdlcdev() calls. A later rename changed the local\nvariable name to ndev, but the underlying mismatch remained.\n\nFix this by allocating the HDLC netdev only once and assigning the same\nobject to port->netdev.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/3f85fcd520aa703824b1958f35169925ddae2558","https://git.kernel.org/stable/c/77d925b948ee594a79afe66f85bb94b67940140b","https://git.kernel.org/stable/c/8f4c3c384092becbf4835a3f8ed8a3df1f544578","https://git.kernel.org/stable/c/91850f582783098415a334f8bd0a84c87ff15a8c","https://git.kernel.org/stable/c/db818b0e8af7bac16860116a19c341a63d6677b4"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72058","score":0.00215,"percentile":0.11866,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}