Critical Alert 2 Active Exploits Detected Today

CVE-2026-72530 TrueConf Server Code Injection Vulnerability →
CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability →
Powered by CVE Watchtower
×
August 21, 2026

CVE Watchtower


← Back to CVE List

CVE-2026-72240NVD

Vulnerability Summary

In the Linux kernel, the following vulnerability has been resolved:

mfd: sm501: Fix reference leak on failed device registration

When platform_device_register() fails in sm501_register_device(), the
embedded struct device in pdev has already been initialized by
device_initialize(), but the failure path only reports the error and
returns without dropping the device reference for the current platform
device:

sm501_register_device()
-> platform_device_register(pdev)
-> device_initialize(&pdev->dev)
-> setup_pdev_dma_masks(pdev)
-> platform_device_add(pdev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Severity Level
UNKNOWN
Published Date
Aug 15, 2026
Last Modified
Aug 17, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.21%Probability
Root Weakness (CWE)
N/A