Executive brief
The Linux kernel's Qualcomm remoteproc (remote processor) driver manages minidump segments for diagnostic data collection. A memory leak flaw in the qcom_add_minidump_segments() function fails to free allocated memory when segment addition encounters errors, potentially leading to gradual memory exhaustion and system performance degradation over time.
Technical details
This is a memory leak vulnerability in the qcom_common.c driver (remoteproc/qcom module). The vulnerable function qcom_add_minidump_segments() allocates memory via kstrndup() for a minidump region 'name' field but fails to free it when either the kstrndup allocation itself fails or when the subsequent rproc_coredump_add_custom_segment() call fails. The function originally returned immediately on kstrndup() failure without proper cleanup, and did not check the return value of rproc_coredump_add_custom_segment(), leaving allocated names untracked. The fix adds proper error handling with kfree() calls and return value propagation, ensuring allocated memory is freed on both failure paths before the function returns. The vulnerability affects Linux kernel versions from v5.11 onwards and has been patched.
Affected products
- Linux Linux kernel v5.11 and later
Timeline
- 2026-03-18: other: Patch commit 381c8a7a59da06293951c343857f4a2465b2c655 authored
- 2026-07-24: patched: Patch merged into stable tree
- 2026-08-15: disclosed: CVE-2026-72216 published