CVE-2026-72265

A low-impact memory leak was found in the Linux kernel's NVIDIA framebuffer (nvidiafb) driver. When nvidiafb_probe() fails on an error path after nvidia_set_fbinfo() has allocated the framebuffer mode list, that memory is not released, resulting in a small kernel memory leak per failed probe attempt. Triggering the flaw requires local access with privileges sufficient to influence driver loading, device binding, or PCI framebuffer probe conditions, and the consequence is limited to memory exhaustion (denial of service) after repeated failed probes; confidentiality and integrity are not affected. Red Hat Product Security rates this flaw Low impact because the leak occurs only on driver probe error paths, reliable triggering requires local privileged access, and no information disclosure or arbitrary-write primitive is exposed; this is a lower severity than the CVSS 3.1 base score of 5.5 (Moderate), which reflects the worst-case availability impact. Red Hat Enterprise Linux 8 kernel and kernel-rt are affected; the fix is deferred for the affected RHEL 8 update streams because this is a low-severity resource leak on an error path with no direct security consequence, and the residual risk is limited to gradual memory consumption on systems that repeatedly trigger failed nvidiafb probes. Other Red Hat products, including Red Hat Enterprise Linux 6, 7, 9, and 10 and Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in their kernels.