CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2010 vulnerabilities reference this CWE, most recent first.
GHSA-857R-XMRG-GJ95
Vulnerability from github – Published: 2024-05-01 15:30 – Updated: 2025-09-18 18:30In the Linux kernel, the following vulnerability has been resolved:
virtio: packed: fix unmap leak for indirect desc table
When use_dma_api and premapped are true, then the do_unmap is false.
Because the do_unmap is false, vring_unmap_extra_packed is not called by detach_buf_packed.
if (unlikely(vq->do_unmap)) { curr = id; for (i = 0; i < state->num; i++) { vring_unmap_extra_packed(vq, &vq->packed.desc_extra[curr]); curr = vq->packed.desc_extra[curr].next; } }
So the indirect desc table is not unmapped. This causes the unmap leak.
So here, we check vq->use_dma_api instead. Synchronously, dma info is updated based on use_dma_api judgment
This bug does not occur, because no driver use the premapped with indirect.
{
"affected": [],
"aliases": [
"CVE-2024-27066"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-01T13:15:50Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: packed: fix unmap leak for indirect desc table\n\nWhen use_dma_api and premapped are true, then the do_unmap is false.\n\nBecause the do_unmap is false, vring_unmap_extra_packed is not called by\ndetach_buf_packed.\n\n if (unlikely(vq-\u003edo_unmap)) {\n curr = id;\n for (i = 0; i \u003c state-\u003enum; i++) {\n vring_unmap_extra_packed(vq,\n \u0026vq-\u003epacked.desc_extra[curr]);\n curr = vq-\u003epacked.desc_extra[curr].next;\n }\n }\n\nSo the indirect desc table is not unmapped. This causes the unmap leak.\n\nSo here, we check vq-\u003euse_dma_api instead. Synchronously, dma info is\nupdated based on use_dma_api judgment\n\nThis bug does not occur, because no driver use the premapped with\nindirect.",
"id": "GHSA-857r-xmrg-gj95",
"modified": "2025-09-18T18:30:21Z",
"published": "2024-05-01T15:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27066"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-85J4-7FM7-86X3
Vulnerability from github – Published: 2026-02-04 18:30 – Updated: 2026-03-18 18:31In the Linux kernel, the following vulnerability has been resolved:
can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak").
In esd_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In esd_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esd_usb_close().
Fix the memory leak by anchoring the URB in the esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.
{
"affected": [],
"aliases": [
"CVE-2026-23075"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-04T17:16:18Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak\n\nFix similar memory leak as in commit 7352e1d5932a (\"can: gs_usb:\ngs_usb_receive_bulk_callback(): fix URB memory leak\").\n\nIn esd_usb_open(), the URBs for USB-in transfers are allocated, added to\nthe dev-\u003erx_submitted anchor and submitted. In the complete callback\nesd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In\nesd_usb_close() the URBs are freed by calling\nusb_kill_anchored_urbs(\u0026dev-\u003erx_submitted).\n\nHowever, this does not take into account that the USB framework unanchors\nthe URB before the complete function is called. This means that once an\nin-URB has been completed, it is no longer anchored and is ultimately not\nreleased in esd_usb_close().\n\nFix the memory leak by anchoring the URB in the\nesd_usb_read_bulk_callback() to the dev-\u003erx_submitted anchor.",
"id": "GHSA-85j4-7fm7-86x3",
"modified": "2026-03-18T18:31:11Z",
"published": "2026-02-04T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23075"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5a4391bdc6c8357242f62f22069c865b792406b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/92d26ce07ac3b7a850dc68c8d73d487b39c39b33"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/93b34d4ba7266030801a509c088ac77c0d7a12e9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9d1807b442fc3286b204f8e59981b10e743533ce"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a9503ae43256e80db5cba9d449b238607164c51d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/adec5e1f9c99fe079ec4c92cca3f1109a3e257c3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dc934d96673992af8568664c1b58e13eb164010d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-863V-GCWH-WP4V
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-06-25 21:31In the Linux kernel, the following vulnerability has been resolved:
soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
In svs_enable_debug_write(), the buf allocated by memdup_user_nul() is leaked if kstrtoint() fails.
Fix this by using __free(kfree) to automatically free buf, eliminating the need for explicit kfree() calls and preventing leaks.
[Angelo: Added missing cleanup.h inclusion]
{
"affected": [],
"aliases": [
"CVE-2026-45881"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T14:17:01Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: mediatek: svs: Fix memory leak in svs_enable_debug_write()\n\nIn svs_enable_debug_write(), the buf allocated by memdup_user_nul()\nis leaked if kstrtoint() fails.\n\nFix this by using __free(kfree) to automatically free buf, eliminating\nthe need for explicit kfree() calls and preventing leaks.\n\n[Angelo: Added missing cleanup.h inclusion]",
"id": "GHSA-863v-gcwh-wp4v",
"modified": "2026-06-25T21:31:19Z",
"published": "2026-05-27T15:33:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45881"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/06195456c4e4de3826c4ca60eca941c472f991d0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0f6498077faa9cd89bb787bcc57063494a6f0601"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/47a3e372f7d68776adb749a27c0ec9058ff1b4fd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6259094ee806fb813ca95894c65fb80e2ec98bf1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6bb10466e0884b4a68d4a1f3f4bb87eeb471c18a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a58c97828911c0b6e25d6b556789da974003efda"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-866G-H3VJ-MMQR
Vulnerability from github – Published: 2025-03-18 21:31 – Updated: 2025-03-18 21:31In the Linux kernel, the following vulnerability has been resolved:
gpu: host1x: Fix a memory leak in 'host1x_remove()'
Add a missing 'host1x_channel_list_free()' call in the remove function, as already done in the error handling path of the probe function.
{
"affected": [],
"aliases": [
"CVE-2021-47648"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T06:37:06Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix a memory leak in \u0027host1x_remove()\u0027\n\nAdd a missing \u0027host1x_channel_list_free()\u0027 call in the remove function,\nas already done in the error handling path of the probe function.",
"id": "GHSA-866g-h3vj-mmqr",
"modified": "2025-03-18T21:31:58Z",
"published": "2025-03-18T21:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47648"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/025c6643a81564f066d8381b9e2f4603e0f8438f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5124a344983e1b9670dae7add0e4d00d589aabcd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6bb107332db28a0e9256c2d36a0902b85307612c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c06577a80485511b894cb688e881ef0bc2d1d296"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fe1ce680560d4f0049ffa0c687de17567421c1ec"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-868C-7V9P-GMXP
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2023-08-16 18:30A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The vulnerability is due to incorrect processing of certain OSPF packets. An attacker could exploit this vulnerability by sending a series of crafted OSPF packets to be processed by an affected device. A successful exploit could allow the attacker to continuously consume memory on an affected device and eventually cause it to reload, resulting in a denial of service (DoS) condition.
{
"affected": [],
"aliases": [
"CVE-2020-3195"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-06T17:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The vulnerability is due to incorrect processing of certain OSPF packets. An attacker could exploit this vulnerability by sending a series of crafted OSPF packets to be processed by an affected device. A successful exploit could allow the attacker to continuously consume memory on an affected device and eventually cause it to reload, resulting in a denial of service (DoS) condition.",
"id": "GHSA-868c-7v9p-gmxp",
"modified": "2023-08-16T18:30:18Z",
"published": "2022-05-24T17:17:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3195"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-ospf-memleak-DHpsgfnv"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-86QR-6525-5M7V
Vulnerability from github – Published: 2025-02-05 18:34 – Updated: 2025-02-05 18:34When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
{
"affected": [],
"aliases": [
"CVE-2025-21091"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T18:15:30Z",
"severity": "HIGH"
},
"details": "When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization.\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated",
"id": "GHSA-86qr-6525-5m7v",
"modified": "2025-02-05T18:34:46Z",
"published": "2025-02-05T18:34:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21091"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000140933"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-86R4-3X7H-8GH4
Vulnerability from github – Published: 2025-09-16 18:31 – Updated: 2025-12-02 00:31In the Linux kernel, the following vulnerability has been resolved:
floppy: Fix memory leak in do_floppy_init()
A memory leak was reported when floppy_alloc_disk() failed in do_floppy_init().
unreferenced object 0xffff888115ed25a0 (size 8): comm "modprobe", pid 727, jiffies 4295051278 (age 25.529s) hex dump (first 8 bytes): 00 ac 67 5b 81 88 ff ff ..g[.... backtrace: [<000000007f457abb>] __kmalloc_node+0x4c/0xc0 [<00000000a87bfa9e>] blk_mq_realloc_tag_set_tags.part.0+0x6f/0x180 [<000000006f02e8b1>] blk_mq_alloc_tag_set+0x573/0x1130 [<0000000066007fd7>] 0xffffffffc06b8b08 [<0000000081f5ac40>] do_one_initcall+0xd0/0x4f0 [<00000000e26d04ee>] do_init_module+0x1a4/0x680 [<000000001bb22407>] load_module+0x6249/0x7110 [<00000000ad31ac4d>] __do_sys_finit_module+0x140/0x200 [<000000007bddca46>] do_syscall_64+0x35/0x80 [<00000000b5afec39>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810fc30540 (size 32): comm "modprobe", pid 727, jiffies 4295051278 (age 25.529s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000007f457abb>] __kmalloc_node+0x4c/0xc0 [<000000006b91eab4>] blk_mq_alloc_tag_set+0x393/0x1130 [<0000000066007fd7>] 0xffffffffc06b8b08 [<0000000081f5ac40>] do_one_initcall+0xd0/0x4f0 [<00000000e26d04ee>] do_init_module+0x1a4/0x680 [<000000001bb22407>] load_module+0x6249/0x7110 [<00000000ad31ac4d>] __do_sys_finit_module+0x140/0x200 [<000000007bddca46>] do_syscall_64+0x35/0x80 [<00000000b5afec39>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
If the floppy_alloc_disk() failed, disks of current drive will not be set, thus the lastest allocated set->tag cannot be freed in the error handling path. A simple call graph shown as below:
floppy_module_init() floppy_init() do_floppy_init() for (drive = 0; drive < N_DRIVE; drive++) blk_mq_alloc_tag_set() blk_mq_alloc_tag_set_tags() blk_mq_realloc_tag_set_tags() # set->tag allocated floppy_alloc_disk() blk_mq_alloc_disk() # error occurred, disks failed to allocated
->out_put_disk:
for (drive = 0; drive < N_DRIVE; drive++)
if (!disks[drive][0]) # the last disks is not set and loop break
break;
blk_mq_free_tag_set() # the latest allocated set->tag leaked
Fix this problem by free the set->tag of current drive before jump to error handling path.
[efremov: added stable list, changed title]
{
"affected": [],
"aliases": [
"CVE-2022-50342"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-16T17:15:33Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfloppy: Fix memory leak in do_floppy_init()\n\nA memory leak was reported when floppy_alloc_disk() failed in\ndo_floppy_init().\n\nunreferenced object 0xffff888115ed25a0 (size 8):\n comm \"modprobe\", pid 727, jiffies 4295051278 (age 25.529s)\n hex dump (first 8 bytes):\n 00 ac 67 5b 81 88 ff ff ..g[....\n backtrace:\n [\u003c000000007f457abb\u003e] __kmalloc_node+0x4c/0xc0\n [\u003c00000000a87bfa9e\u003e] blk_mq_realloc_tag_set_tags.part.0+0x6f/0x180\n [\u003c000000006f02e8b1\u003e] blk_mq_alloc_tag_set+0x573/0x1130\n [\u003c0000000066007fd7\u003e] 0xffffffffc06b8b08\n [\u003c0000000081f5ac40\u003e] do_one_initcall+0xd0/0x4f0\n [\u003c00000000e26d04ee\u003e] do_init_module+0x1a4/0x680\n [\u003c000000001bb22407\u003e] load_module+0x6249/0x7110\n [\u003c00000000ad31ac4d\u003e] __do_sys_finit_module+0x140/0x200\n [\u003c000000007bddca46\u003e] do_syscall_64+0x35/0x80\n [\u003c00000000b5afec39\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\nunreferenced object 0xffff88810fc30540 (size 32):\n comm \"modprobe\", pid 727, jiffies 4295051278 (age 25.529s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [\u003c000000007f457abb\u003e] __kmalloc_node+0x4c/0xc0\n [\u003c000000006b91eab4\u003e] blk_mq_alloc_tag_set+0x393/0x1130\n [\u003c0000000066007fd7\u003e] 0xffffffffc06b8b08\n [\u003c0000000081f5ac40\u003e] do_one_initcall+0xd0/0x4f0\n [\u003c00000000e26d04ee\u003e] do_init_module+0x1a4/0x680\n [\u003c000000001bb22407\u003e] load_module+0x6249/0x7110\n [\u003c00000000ad31ac4d\u003e] __do_sys_finit_module+0x140/0x200\n [\u003c000000007bddca46\u003e] do_syscall_64+0x35/0x80\n [\u003c00000000b5afec39\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nIf the floppy_alloc_disk() failed, disks of current drive will not be set,\nthus the lastest allocated set-\u003etag cannot be freed in the error handling\npath. A simple call graph shown as below:\n\n floppy_module_init()\n floppy_init()\n do_floppy_init()\n for (drive = 0; drive \u003c N_DRIVE; drive++)\n blk_mq_alloc_tag_set()\n blk_mq_alloc_tag_set_tags()\n blk_mq_realloc_tag_set_tags() # set-\u003etag allocated\n floppy_alloc_disk()\n blk_mq_alloc_disk() # error occurred, disks failed to allocated\n\n -\u003eout_put_disk:\n for (drive = 0; drive \u003c N_DRIVE; drive++)\n if (!disks[drive][0]) # the last disks is not set and loop break\n break;\n blk_mq_free_tag_set() # the latest allocated set-\u003etag leaked\n\nFix this problem by free the set-\u003etag of current drive before jump to\nerror handling path.\n\n[efremov: added stable list, changed title]",
"id": "GHSA-86r4-3x7h-8gh4",
"modified": "2025-12-02T00:31:10Z",
"published": "2025-09-16T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50342"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/55b3c66a0d441cd37154ae95e44d0b82ccfd580e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/75d8c8851a4da0190c2480e84315b5fd3d0356c5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f36d8c8651506aea5f09899f5356ece5d1384f50"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f8ace2e304c5dd8a7328db9cd2b8a4b1b98d83ec"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-86V6-W4RR-WRW5
Vulnerability from github – Published: 2024-05-01 06:31 – Updated: 2024-06-03 18:55In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix memory leak in create_process failure
Fix memory leak due to a leaked mmget reference on an error handling code path that is triggered when attempting to create KFD processes while a GPU reset is in progress.
{
"affected": [],
"aliases": [
"CVE-2024-26986"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-01T06:15:16Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix memory leak in create_process failure\n\nFix memory leak due to a leaked mmget reference on an error handling\ncode path that is triggered when attempting to create KFD processes\nwhile a GPU reset is in progress.",
"id": "GHSA-86v6-w4rr-wrw5",
"modified": "2024-06-03T18:55:51Z",
"published": "2024-05-01T06:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26986"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0dcd876411644da98a6b4d5a18d32ca94c15bdb5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/18921b205012568b45760753ad3146ddb9e2d4e2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aa02d43367a9adf8c85fb382fea4171fb266c8d0"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-874P-F6C3-782R
Vulnerability from github – Published: 2024-12-27 15:31 – Updated: 2025-11-03 21:31In the Linux kernel, the following vulnerability has been resolved:
drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
If we fail to allocate memory for cb_data by kmalloc, the memory allocation for eve_data is never freed, add the missing kfree() in the error handling path.
{
"affected": [],
"aliases": [
"CVE-2024-56546"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T14:15:34Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()\n\nIf we fail to allocate memory for cb_data by kmalloc, the memory\nallocation for eve_data is never freed, add the missing kfree()\nin the error handling path.",
"id": "GHSA-874p-f6c3-782r",
"modified": "2025-11-03T21:31:50Z",
"published": "2024-12-27T15:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56546"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/272168927f38bda46f6c1ed5f40de97689e7a5d2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/44ed4f90a97ff6f339e50ac01db71544e0990efc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/584d420771e1ad2bb74e19a19da8ae0fee0a6e1f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5a3bda42394ff137eb2d3d3d20d2956a8c6e9237"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/882d7afaa4b82c20a7be7a3a039532a80ebacd23"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-87JJ-2MGC-93QW
Vulnerability from github – Published: 2024-10-21 12:30 – Updated: 2024-10-22 18:32In the Linux kernel, the following vulnerability has been resolved:
exfat: resolve memory leak from exfat_create_upcase_table()
If exfat_load_upcase_table reaches end and returns -EINVAL, allocated memory doesn't get freed and while exfat_load_default_upcase_table allocates more memory, leading to a memory leak.
Here's link to syzkaller crash report illustrating this issue: https://syzkaller.appspot.com/text?tag=CrashReport&x=1406c201980000
{
"affected": [],
"aliases": [
"CVE-2024-47677"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-21T12:15:04Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: resolve memory leak from exfat_create_upcase_table()\n\nIf exfat_load_upcase_table reaches end and returns -EINVAL,\nallocated memory doesn\u0027t get freed and while\nexfat_load_default_upcase_table allocates more memory, leading to a\nmemory leak.\n\nHere\u0027s link to syzkaller crash report illustrating this issue:\nhttps://syzkaller.appspot.com/text?tag=CrashReport\u0026x=1406c201980000",
"id": "GHSA-87jj-2mgc-93qw",
"modified": "2024-10-22T18:32:09Z",
"published": "2024-10-21T12:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47677"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/331ed2c739ce656a67865f6b3ee0a478349d78cb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c290fe508eee36df1640c3cb35dc8f89e073c8a8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f9835aec49670c46ebe2973032caaa1043b3d4da"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.