Linux Kernel CVE-2026-72406

The sungem driver (drivers/net/ethernet/sun/sungem.c) supports Sun Microsystems GEM (Gigabit Ethernet) chips found in older Sun workstations and Apple PowerPC-based hardware from roughly 2000-2005. The defect is a classic probe error cleanup race: gem_init_one() calls gem_remove_one() upon register_netdev() failure, but gem_remove_one() already deallocates all device-owned resources including the DMA coherent block, MMIO region, PCI BARs, and the net_device structure itself via free_netdev(). gem_init_one() then continues executing through its own error-path goto labels and attempts to release those same resources a second time, producing a double-free in kernel heap memory. Although CWE is formally unassigned, this maps to CWE-415 (Double Free) and CWE-672 (Operation on Resource After Expiration). The fix clears drvdata to prevent PM and remove paths from seeing a half-registered device, removes the NAPI instance added during probe, and permits the existing cleanup labels to release resources exactly once. CPE cpe:2.3:a:linux:linux:* confirms all Linux kernel builds from the initial git history commit (1da177e4c3f4, Linux 2.6.12) through unpatched stable branches are affected. The bug was identified by static analysis of probe error paths and has not been runtime-tested due to unavailability of sungem hardware.