CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2014 vulnerabilities reference this CWE, most recent first.
GHSA-FQJW-RGV6-J77Q
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scenarios, a local attacker with device permissions repeatedly attenuated the optical signal to cause memory leak and abnormal service. This affects: ZXR10 8900E, all versions up to V3.03.20R2B30P1.
{
"affected": [],
"aliases": [
"CVE-2021-21724"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-26T03:15:00Z",
"severity": "MODERATE"
},
"details": "A ZTE product has a memory leak vulnerability. Due to the product\u0027s improper handling of memory release in certain scenarios, a local attacker with device permissions repeatedly attenuated the optical signal to cause memory leak and abnormal service. This affects: ZXR10 8900E, all versions up to V3.03.20R2B30P1.",
"id": "GHSA-fqjw-rgv6-j77q",
"modified": "2022-05-24T17:43:11Z",
"published": "2022-05-24T17:43:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21724"
},
{
"type": "WEB",
"url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014584"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FQMF-FV5C-GPV2
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-05-24 17:45A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is reached or Privoxy is running out of memory can lead to a system crash.
{
"affected": [],
"aliases": [
"CVE-2020-35502"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-25T19:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is reached or Privoxy is running out of memory can lead to a system crash.",
"id": "GHSA-fqmf-fv5c-gpv2",
"modified": "2022-05-24T17:45:20Z",
"published": "2022-05-24T17:45:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35502"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928749"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202107-16"
},
{
"type": "WEB",
"url": "https://www.privoxy.org/3.0.29/user-manual/whatsnew.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FQVX-XPV6-VJ7W
Vulnerability from github – Published: 2025-05-02 18:31 – Updated: 2025-11-10 18:30In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()
Add a missing resource clean up in .remove.
{
"affected": [],
"aliases": [
"CVE-2023-53127"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-02T16:15:31Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix expander node leak in mpi3mr_remove()\n\nAdd a missing resource clean up in .remove.",
"id": "GHSA-fqvx-xpv6-vj7w",
"modified": "2025-11-10T18:30:30Z",
"published": "2025-05-02T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53127"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0023972a7593720f8878aed06c03ac9e541078be"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ce756daa36e1ba271bb3334267295e447aa57a5c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cf9777be5683c5e55680c089df02ee27d2226aa8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FR44-546P-7XCP
Vulnerability from github – Published: 2023-10-10 22:23 – Updated: 2024-06-03 18:31Impact
The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.
Patches
The following patch was made:
- Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb
Workarounds
Beyond upgrading to the patched versions, there is no other workaround.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.Native.Quic.MsQuic.OpenSSL"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.Native.Quic.MsQuic.Schannel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-36435"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-401"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-10T22:23:28Z",
"nvd_published_at": "2023-10-10T18:15:12Z",
"severity": "HIGH"
},
"details": "### Impact\nThe MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.\n\n### Patches\nThe following patch was made:\n\n- Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb\n\n### Workarounds\nBeyond upgrading to the patched versions, there is no other workaround.\n",
"id": "GHSA-fr44-546p-7xcp",
"modified": "2024-06-03T18:31:15Z",
"published": "2023-10-10T22:23:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/microsoft/msquic/security/advisories/GHSA-fr44-546p-7xcp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36435"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb"
},
{
"type": "PACKAGE",
"url": "https://github.com/microsoft/msquic"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36435"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "MsQuic Remote Denial of Service Vulnerability"
}
GHSA-FRGF-8JR5-J2JV
Vulnerability from github – Published: 2023-10-30 21:33 – Updated: 2026-06-08 23:16A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rmagick"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-5349"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-401"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-31T19:41:15Z",
"nvd_published_at": "2023-10-30T21:15:07Z",
"severity": "MODERATE"
},
"details": "A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.",
"id": "GHSA-frgf-8jr5-j2jv",
"modified": "2026-06-08T23:16:29Z",
"published": "2023-10-30T21:33:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5349"
},
{
"type": "WEB",
"url": "https://github.com/rmagick/rmagick/issues/1401"
},
{
"type": "WEB",
"url": "https://github.com/rmagick/rmagick/pull/1406"
},
{
"type": "WEB",
"url": "https://github.com/rmagick/rmagick/commit/02f37ca0d6c2b8fff316e0668efa690f5c90a429"
},
{
"type": "WEB",
"url": "https://github.com/rmagick/rmagick/commit/fec7a7e639ae565386f7615155dbcf49b957b64a"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-5349"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2247064"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-frgf-8jr5-j2jv"
},
{
"type": "PACKAGE",
"url": "https://github.com/rmagick/rmagick"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rmagick/CVE-2023-5349.yml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00030.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00003.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S3XMQ2KWPYGT447EKPENGXXHKAQ5NUWF"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "memory leak flaw was found in ruby-magick"
}
GHSA-FRJ7-889M-PJX6
Vulnerability from github – Published: 2022-05-24 16:49 – Updated: 2023-02-23 15:33ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
{
"affected": [],
"aliases": [
"CVE-2019-13301"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-05T01:15:00Z",
"severity": "MODERATE"
},
"details": "ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.",
"id": "GHSA-frj7-889m-pjx6",
"modified": "2023-02-23T15:33:05Z",
"published": "2022-05-24T16:49:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13301"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/issues/1585"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/issues/1589"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/commit/f595a1985233c399a05c0c37cc41de16a90dd025"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4192-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4712"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FV3V-376J-HCPX
Vulnerability from github – Published: 2025-10-01 12:30 – Updated: 2026-01-16 21:30In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()
In rtw_init_drv_sw(), there are various init functions are called to populate the padapter structure and some checks for their return value. However, except for the first one error path, the other five error paths do not properly release the previous allocated resources, which leads to various memory leaks.
This patch fixes them and keeps the success and error separate.
Note that these changes keep the form of rtw_init_drv_sw() in
"drivers/staging/r8188eu/os_dep/os_intfs.c". As there is no proper device
to test with, no runtime testing was performed.
{
"affected": [],
"aliases": [
"CVE-2022-50469"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-01T12:15:40Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()\n\nIn rtw_init_drv_sw(), there are various init functions are called to\npopulate the padapter structure and some checks for their return value.\nHowever, except for the first one error path, the other five error paths\ndo not properly release the previous allocated resources, which leads to\nvarious memory leaks.\n\nThis patch fixes them and keeps the success and error separate.\nNote that these changes keep the form of `rtw_init_drv_sw()` in\n\"drivers/staging/r8188eu/os_dep/os_intfs.c\". As there is no proper device\nto test with, no runtime testing was performed.",
"id": "GHSA-fv3v-376j-hcpx",
"modified": "2026-01-16T21:30:29Z",
"published": "2025-10-01T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50469"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5a5aa9cce621e2c0e25a1e5d72d6be1749167cc0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6b2052b365f8035ab7f09ac24b5b499002b298cb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b4573a2bad3c3e2643ef3939079eb7035a30e6ee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d95d1526d9f06978c1a7186810a5490d72c62742"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FV6M-6723-V88J
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-03 21:30In the Linux kernel, the following vulnerability has been resolved:
media: airspy: fix memory leak in airspy probe
The commit ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing deallocation in the success path.
Fix this by freeing buf in the success path since this variable does not have any references in other code.
{
"affected": [],
"aliases": [
"CVE-2022-50326"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T15:15:44Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: airspy: fix memory leak in airspy probe\n\nThe commit ca9dc8d06ab6 (\"media: airspy: respect the DMA coherency\n rules\") moves variable buf from stack to heap, however, it only frees\nbuf in the error handling code, missing deallocation in the success\npath.\n\nFix this by freeing buf in the success path since this variable does not\nhave any references in other code.",
"id": "GHSA-fv6m-6723-v88j",
"modified": "2025-12-03T21:30:59Z",
"published": "2025-09-15T15:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50326"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/23bc5eb55f8c9607965c20d9ddcc13cb1ae59568"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f4285dd02b6b2ca3435b65fb62c053dd9408fd71"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FV7C-CVJ6-WRFG
Vulnerability from github – Published: 2025-09-16 18:31 – Updated: 2025-12-01 21:30In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: Fix SKB corruption in REO destination ring
While running traffics for a long time, randomly an RX descriptor filled with value "0" from REO destination ring is received. This descriptor which is invalid causes the wrong SKB (SKB stored in the IDR lookup with buffer id "0") to be fetched which in turn causes SKB memory corruption issue and the same leads to crash after some time.
Changed the start id for idr allocation to "1" and the buffer id "0" is reserved for error validation. Introduced Sanity check to validate the descriptor, before processing the SKB.
Crash Signature :
Unable to handle kernel paging request at virtual address 3f004900 PC points to "b15_dma_inv_range+0x30/0x50" LR points to "dma_cache_maint_page+0x8c/0x128". The Backtrace obtained is as follows: [<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128) [<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc) [<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k]) [<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k]) [<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci]) [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8) [<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280) [<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280) [<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4) [<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4) [<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90) [<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c)
Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
{
"affected": [],
"aliases": [
"CVE-2023-53315"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-16T17:15:37Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: Fix SKB corruption in REO destination ring\n\nWhile running traffics for a long time, randomly an RX descriptor\nfilled with value \"0\" from REO destination ring is received.\nThis descriptor which is invalid causes the wrong SKB (SKB stored in\nthe IDR lookup with buffer id \"0\") to be fetched which in turn\ncauses SKB memory corruption issue and the same leads to crash\nafter some time.\n\nChanged the start id for idr allocation to \"1\" and the buffer id \"0\"\nis reserved for error validation. Introduced Sanity check to validate\nthe descriptor, before processing the SKB.\n\nCrash Signature :\n\nUnable to handle kernel paging request at virtual address 3f004900\nPC points to \"b15_dma_inv_range+0x30/0x50\"\nLR points to \"dma_cache_maint_page+0x8c/0x128\".\nThe Backtrace obtained is as follows:\n[\u003c8031716c\u003e] (b15_dma_inv_range) from [\u003c80313a4c\u003e] (dma_cache_maint_page+0x8c/0x128)\n[\u003c80313a4c\u003e] (dma_cache_maint_page) from [\u003c80313b90\u003e] (__dma_page_dev_to_cpu+0x28/0xcc)\n[\u003c80313b90\u003e] (__dma_page_dev_to_cpu) from [\u003c7fb5dd68\u003e] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k])\n[\u003c7fb5dd68\u003e] (ath11k_dp_process_rx [ath11k]) from [\u003c7fb53c20\u003e] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k])\n[\u003c7fb53c20\u003e] (ath11k_dp_service_srng [ath11k]) from [\u003c7f67bba4\u003e] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci])\n[\u003c7f67bba4\u003e] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [\u003c807d5cf4\u003e] (__napi_poll+0x28/0xb8)\n[\u003c807d5cf4\u003e] (__napi_poll) from [\u003c807d5f28\u003e] (net_rx_action+0xf0/0x280)\n[\u003c807d5f28\u003e] (net_rx_action) from [\u003c80302148\u003e] (__do_softirq+0xd0/0x280)\n[\u003c80302148\u003e] (__do_softirq) from [\u003c80320408\u003e] (irq_exit+0x74/0xd4)\n[\u003c80320408\u003e] (irq_exit) from [\u003c803638a4\u003e] (__handle_domain_irq+0x90/0xb4)\n[\u003c803638a4\u003e] (__handle_domain_irq) from [\u003c805bedec\u003e] (gic_handle_irq+0x58/0x90)\n[\u003c805bedec\u003e] (gic_handle_irq) from [\u003c80301a78\u003e] (__irq_svc+0x58/0x8c)\n\nTested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1",
"id": "GHSA-fv7c-cvj6-wrfg",
"modified": "2025-12-01T21:30:22Z",
"published": "2025-09-16T18:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53315"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/068fd06148fbf0af95bb08dc77cff34ee679fdbc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3d3f8fe01a01d94a17fe1ae0d2e894049a972717"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/67459491f78146bcf7d93596e5b709d063dff5d8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/866921dc06b94df91acfcf9359b57da943ed99b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f9fff67d2d7ca6fa8066132003a3deef654c55b1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FV85-JGQF-P95R
Vulnerability from github – Published: 2026-05-01 15:30 – Updated: 2026-07-04 12:30In the Linux kernel, the following vulnerability has been resolved:
gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
Since commit aab5c6f20023 ("gpio: set device type for GPIO chips"),
gdev->dev.release is unset. As a result, the reference count to
gdev->dev isn't dropped on the error handling paths.
Drop the reference on errors.
Also reorder the instructions to make the error handling simpler. Now gpiochip_add_data_with_key() roughly looks like:
Some memory allocation. Go to ERR ZONE 1 on errors. device_initialize().
gpiodev_release() takes over the responsibility for freeing the
resources of gdev->dev. The subsequent error handling paths
shouldn't go through ERR ZONE 1 again which leads to double free.
Some initialization mainly on
gdev. The rest of initialization. Go to ERR ZONE 2 on errors. Chip registration success and exit.ERR ZONE 2. gpio_device_put() and exit. ERR ZONE 1.
{
"affected": [],
"aliases": [
"CVE-2026-31732"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-01T15:16:35Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: Fix resource leaks on errors in gpiochip_add_data_with_key()\n\nSince commit aab5c6f20023 (\"gpio: set device type for GPIO chips\"),\n`gdev-\u003edev.release` is unset. As a result, the reference count to\n`gdev-\u003edev` isn\u0027t dropped on the error handling paths.\n\nDrop the reference on errors.\n\nAlso reorder the instructions to make the error handling simpler.\nNow gpiochip_add_data_with_key() roughly looks like:\n\n \u003e\u003e\u003e Some memory allocation. Go to ERR ZONE 1 on errors.\n \u003e\u003e\u003e device_initialize().\n\n gpiodev_release() takes over the responsibility for freeing the\n resources of `gdev-\u003edev`. The subsequent error handling paths\n shouldn\u0027t go through ERR ZONE 1 again which leads to double free.\n\n \u003e\u003e\u003e Some initialization mainly on `gdev`.\n \u003e\u003e\u003e The rest of initialization. Go to ERR ZONE 2 on errors.\n \u003e\u003e\u003e Chip registration success and exit.\n\n \u003e\u003e\u003e ERR ZONE 2. gpio_device_put() and exit.\n \u003e\u003e\u003e ERR ZONE 1.",
"id": "GHSA-fv85-jgqf-p95r",
"modified": "2026-07-04T12:30:27Z",
"published": "2026-05-01T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31732"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/16fdabe143fce2cbf89139677728e17e21b46c28"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a500e1837c4266ddb05b39b3e1cc71f49a43ffa5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f0cf9c7b7c281956cc0dec163132cd96f76e1d60"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fb4584d2b324c522404c733c65840a1a6519ada8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.