Vulnerability-Lookup

GHSA-P9JM-Q85P-7MCP

Vulnerability from github – Published: 2026-08-07 17:16 – Updated: 2026-08-07 17:16

Summary

Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

Details

Summary

RedisArrayAggregator clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk-string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception, but the existing partial aggregate remains retained in the handler.

If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate. The supplied PoV proves both the retained ByteBuf reference and the stale parser state continuation.

Technical Details

RedisArrayAggregator.decode(...) retains non-array messages before adding them to depths.peek().children. In decodeRedisArrayHeader(...), the header.length() > maxElements branch throws immediately:

if (header.length() > maxElements) {
    throw new CodecException("this codec doesn't support longer length than " + maxElements);
}

The immediately following nested-depth branch clears retained aggregate state before throwing:

if (depths.size() >= maxNestedArrayDepth) {
    releaseAndClearDepths();
    throw new CodecException("max nested array depth exceeded: " + maxNestedArrayDepth);
}

The missing cleanup in the first branch leaves retained children and aggregate state reachable after the exception.

PoC

Place the supplied RedisArrayAggregatorIncompleteCleanupPovTest.java under:

codec-redis/src/test/java/io/netty/handler/codec/redis/

Run:

./mvnw -pl codec-redis -am -Dtest=RedisArrayAggregatorIncompleteCleanupPovTest -Dsurefire.failIfNoSpecifiedTests=false -DskipNativeTests -DskipAutobahnTests test

The test suite includes:

serialized RESP trigger through RedisDecoder, RedisBulkStringAggregator, and RedisArrayAggregator;
direct refcount proof that max-elements overflow does not release the retained child immediately;
post-exception continuation proof that the stale aggregate consumes a later message;
nested-depth controls that clear the same partial aggregate state.

All five tests pass on current 4.2, 4.2.15.Final, and 4.1.135.Final.

Impact

For Redis codec pipelines that continue after codec exceptions, an unauthenticated peer can keep attacker-controlled aggregate state alive across a security-limit exception. This can pin retained pooled buffers until channel close/removal or until a later message completes the stale aggregate.

RedisBulkStringAggregator permits bulk strings up to RedisConstants.REDIS_MESSAGE_MAX_LENGTH (512MB), so the retained child can be large in deployments that aggregate untrusted Redis streams.

Applications that always close the channel or remove the handler on decoder exceptions will trigger existing cleanup; the issue is the missing immediate cleanup on the max-elements failure path while the handler remains installed.

Suggested Fix

Call releaseAndClearDepths() before throwing from the max-elements branch. Consider applying the same cleanup to all unrecoverable decodeRedisArrayHeader(...) error exits that can occur while depths is non-empty.

Affected Package/Versions

io.netty:netty-codec-redis

Confirmed on:

current 4.2 branch head 7bae566a93e69409697fe57fa807910ba5c9720e
4.2.15.Final at a41f7b289ce1
4.1.135.Final at f05f765d8146

Advisory History

This differs from the public Redis codec advisories because it reproduces on their patched tags:

GHSA-5w86-c3rq-vjj7
GHSA-3244-j874-rhc2 / CVE-2026-44250
GHSA-6jv9-x5w9-2ccm / CVE-2026-48006
GHSA-6ghj-frrj-jjj3 / CVE-2026-44890

Why This Is Not Intended Behavior

The public API docs document RedisArrayAggregator as aggregating RedisMessage parts into ArrayRedisMessage and document a CodecException when an array header exceeds maxElements. They do not document preserving pre-exception partial aggregate state after that limit fires.

The adjacent nested-depth branch already calls releaseAndClearDepths() before throwing. The max-elements branch is the sibling aggregation-limit branch but throws without cleanup. Netty's later Redis lifecycle cleanup patch explicitly added release behavior for nested-array failure and handler removal, leaving the max-elements failure branch as a missed cleanup path.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-codec-redis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.136.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-codec-redis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0-Final"
            },
            {
              "fixed": "4.2.16.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56818"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401",
      "CWE-703"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-07T17:16:13Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`RedisArrayAggregator` clears retained partial aggregate state when the `maxNestedArrayDepth` limit is exceeded, but it does not clear the same state when the sibling `maxElements` limit is exceeded. A peer can start a valid RESP array, send a bulk-string child, then send a nested array header longer than the configured `maxElements`. Netty throws a decoder exception, but the existing partial aggregate remains retained in the handler.\n\nIf the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate. The supplied PoV proves both the retained `ByteBuf` reference and the stale parser state continuation.\n\n## Technical Details\n\n`RedisArrayAggregator.decode(...)` retains non-array messages before adding them to `depths.peek().children`. In `decodeRedisArrayHeader(...)`, the `header.length() \u003e maxElements` branch throws immediately:\n\n```java\nif (header.length() \u003e maxElements) {\n    throw new CodecException(\"this codec doesn\u0027t support longer length than \" + maxElements);\n}\n```\n\nThe immediately following nested-depth branch clears retained aggregate state before throwing:\n\n```java\nif (depths.size() \u003e= maxNestedArrayDepth) {\n    releaseAndClearDepths();\n    throw new CodecException(\"max nested array depth exceeded: \" + maxNestedArrayDepth);\n}\n```\n\nThe missing cleanup in the first branch leaves retained children and aggregate state reachable after the exception.\n\n## PoC\n\nPlace the supplied `RedisArrayAggregatorIncompleteCleanupPovTest.java` under:\n\n`codec-redis/src/test/java/io/netty/handler/codec/redis/`\n\nRun:\n\n```fish\n./mvnw -pl codec-redis -am -Dtest=RedisArrayAggregatorIncompleteCleanupPovTest -Dsurefire.failIfNoSpecifiedTests=false -DskipNativeTests -DskipAutobahnTests test\n```\n\nThe test suite includes:\n\n- serialized RESP trigger through `RedisDecoder`, `RedisBulkStringAggregator`, and `RedisArrayAggregator`;\n- direct refcount proof that max-elements overflow does not release the retained child immediately;\n- post-exception continuation proof that the stale aggregate consumes a later message;\n- nested-depth controls that clear the same partial aggregate state.\n\nAll five tests pass on current `4.2`, `4.2.15.Final`, and `4.1.135.Final`.\n\n## Impact\n\nFor Redis codec pipelines that continue after codec exceptions, an unauthenticated peer can keep attacker-controlled aggregate state alive across a security-limit exception. This can pin retained pooled buffers until channel close/removal or until a later message completes the stale aggregate.\n\n`RedisBulkStringAggregator` permits bulk strings up to `RedisConstants.REDIS_MESSAGE_MAX_LENGTH` (`512MB`), so the retained child can be large in deployments that aggregate untrusted Redis streams.\n\nApplications that always close the channel or remove the handler on decoder exceptions will trigger existing cleanup; the issue is the missing immediate cleanup on the max-elements failure path while the handler remains installed.\n\n## Suggested Fix\n\nCall `releaseAndClearDepths()` before throwing from the max-elements branch. Consider applying the same cleanup to all unrecoverable `decodeRedisArrayHeader(...)` error exits that can occur while `depths` is non-empty.\n\n## Affected Package/Versions\n\n`io.netty:netty-codec-redis`\n\nConfirmed on:\n\n- current `4.2` branch head `7bae566a93e69409697fe57fa807910ba5c9720e`\n- `4.2.15.Final` at `a41f7b289ce1`\n- `4.1.135.Final` at `f05f765d8146`\n\n## Advisory History\n\nThis differs from the public Redis codec advisories because it reproduces on their patched tags:\n\n- `GHSA-5w86-c3rq-vjj7`\n- `GHSA-3244-j874-rhc2` / `CVE-2026-44250`\n- `GHSA-6jv9-x5w9-2ccm` / `CVE-2026-48006`\n- `GHSA-6ghj-frrj-jjj3` / `CVE-2026-44890`\n\n## Why This Is Not Intended Behavior\n\nThe public API docs document `RedisArrayAggregator` as aggregating `RedisMessage` parts into `ArrayRedisMessage` and document a `CodecException` when an array header exceeds `maxElements`. They do not document preserving pre-exception partial aggregate state after that limit fires.\n\nThe adjacent nested-depth branch already calls `releaseAndClearDepths()` before throwing. The max-elements branch is the sibling aggregation-limit branch but throws without cleanup. Netty\u0027s later Redis lifecycle cleanup patch explicitly added release behavior for nested-array failure and handler removal, leaving the max-elements failure branch as a missed cleanup path.",
  "id": "GHSA-p9jm-q85p-7mcp",
  "modified": "2026-08-07T17:16:13Z",
  "published": "2026-08-07T17:16:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/security/advisories/GHSA-p9jm-q85p-7mcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/pull/17065"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/netty/netty"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state"
}

GHSA-PC3Q-7XFR-H5H3

Vulnerability from github – Published: 2025-06-18 12:30 – Updated: 2026-01-30 12:31

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: csa unmap use uninterruptible lock

After process exit to unmap csa and free GPU vm, if signal is accepted and then waiting to take vm lock is interrupted and return, it causes memory leaking and below warning backtrace.

Change to use uninterruptible wait lock fix the issue.

WARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525 amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu] Call Trace: drm_file_free.part.0+0x1da/0x230 [drm] drm_close_helper.isra.0+0x65/0x70 [drm] drm_release+0x6a/0x120 [drm] amdgpu_drm_release+0x51/0x60 [amdgpu] __fput+0x9f/0x280 ____fput+0xe/0x20 task_work_run+0x67/0xa0 do_exit+0x217/0x3c0 do_group_exit+0x3b/0xb0 get_signal+0x14a/0x8d0 arch_do_signal_or_restart+0xde/0x100 exit_to_user_mode_loop+0xc1/0x1a0 exit_to_user_mode_prepare+0xf4/0x100 syscall_exit_to_user_mode+0x17/0x40 do_syscall_64+0x69/0xc0

(cherry picked from commit 7dbbfb3c171a6f63b01165958629c9c26abf38ab)

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-38011"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-18T10:15:32Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: csa unmap use uninterruptible lock\n\nAfter process exit to unmap csa and free GPU vm, if signal is accepted\nand then waiting to take vm lock is interrupted and return, it causes\nmemory leaking and below warning backtrace.\n\nChange to use uninterruptible wait lock fix the issue.\n\nWARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525\n amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu]\n Call Trace:\n  \u003cTASK\u003e\n  drm_file_free.part.0+0x1da/0x230 [drm]\n  drm_close_helper.isra.0+0x65/0x70 [drm]\n  drm_release+0x6a/0x120 [drm]\n  amdgpu_drm_release+0x51/0x60 [amdgpu]\n  __fput+0x9f/0x280\n  ____fput+0xe/0x20\n  task_work_run+0x67/0xa0\n  do_exit+0x217/0x3c0\n  do_group_exit+0x3b/0xb0\n  get_signal+0x14a/0x8d0\n  arch_do_signal_or_restart+0xde/0x100\n  exit_to_user_mode_loop+0xc1/0x1a0\n  exit_to_user_mode_prepare+0xf4/0x100\n  syscall_exit_to_user_mode+0x17/0x40\n  do_syscall_64+0x69/0xc0\n\n(cherry picked from commit 7dbbfb3c171a6f63b01165958629c9c26abf38ab)",
  "id": "GHSA-pc3q-7xfr-h5h3",
  "modified": "2026-01-30T12:31:20Z",
  "published": "2025-06-18T12:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38011"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8d2979b9bb1be0f4a52dff600e56d780403e04ac"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8d71c3231b33e24a911b8f2d8c3a17ee40aa32d5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a0fa7873f2f869087b1e7793f7fac3713a1e3afe"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a1adc8d9a0d219d4e88672c30dbc9ea960d73136"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PC3V-MPGJ-WXWQ

Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-06-19 15:33

Details

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: ns: Free the node during ctrl_cmd_bye()

A node sends the BYE packet when it is about to go down. So the nameserver should advertise the removal of the node to all remote and local observers and free the node finally. But currently, the nameserver doesn't free the node memory even after processing the BYE packet. This causes the node memory to leak.

Hence, remove the node from Xarray list and free the node memory during both success and failure case of ctrl_cmd_bye().

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-46038"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T14:17:23Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Free the node during ctrl_cmd_bye()\n\nA node sends the BYE packet when it is about to go down. So the nameserver\nshould advertise the removal of the node to all remote and local observers\nand free the node finally. But currently, the nameserver doesn\u0027t free the\nnode memory even after processing the BYE packet. This causes the node\nmemory to leak.\n\nHence, remove the node from Xarray list and free the node memory during\nboth success and failure case of ctrl_cmd_bye().",
  "id": "GHSA-pc3v-mpgj-wxwq",
  "modified": "2026-06-19T15:33:13Z",
  "published": "2026-05-27T15:33:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46038"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/076e4b162d6caba12c229e7f262df5b6881162b0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/154fc7fe3f62c46891c3c4302f4b5b5391c932e6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/25d580a46b079a7963ff024a5195e547baf12b64"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/65932f5102bb5377db36c8a4f0c28179a1967a9a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/68efba36446a7774ea5b971257ade049272a07ac"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6c9cca46acb6f22e63f015ea7b2ed6032d2badf5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a5a454f3364877b22f0e5a165df8b3702ff96ae7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ff78ed177a66763085e3214d6fbe13ca8f0b3f11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PC8P-4PFJ-FGM2

Vulnerability from github – Published: 2026-07-13 18:30 – Updated: 2026-08-03 12:32

Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()

hci_le_big_terminate() allocates iso_list_data via kzalloc_obj but returns 0 without freeing it when neither pa_sync_term nor big_sync_term flags are set after evaluating the PA and BIG sync connection state.

This early-return path was introduced when hci_le_big_terminate() was refactored to take struct hci_conn instead of raw u8 parameters, adding PA/BIG flag evaluation logic. The existing kfree() on hci_cmd_sync_queue failure does not cover this path.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-53364"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-13T18:16:28Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()\n\nhci_le_big_terminate() allocates iso_list_data via kzalloc_obj but\nreturns 0 without freeing it when neither pa_sync_term nor big_sync_term\nflags are set after evaluating the PA and BIG sync connection state.\n\nThis early-return path was introduced when hci_le_big_terminate() was\nrefactored to take struct hci_conn instead of raw u8 parameters, adding\nPA/BIG flag evaluation logic. The existing kfree() on hci_cmd_sync_queue\nfailure does not cover this path.",
  "id": "GHSA-pc8p-4pfj-fgm2",
  "modified": "2026-08-03T12:32:36Z",
  "published": "2026-07-13T18:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53364"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/488e808e3fa53200f3ef3324c45fcba4ae9f4972"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a59d4f4217e6200ca9180643e5738a87d3fa8be0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bfa9d28960ed677d556bdf097073bc3129686229"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e6b78019664dfe37c3dc707f50e7b453d6c7726d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PC96-PG3P-MMM7

Vulnerability from github – Published: 2026-09-04 18:31 – Updated: 2026-09-04 18:31

Details

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-18076"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-04T17:16:55Z",
    "severity": "MODERATE"
  },
  "details": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.",
  "id": "GHSA-pc96-pg3p-mmm7",
  "modified": "2026-09-04T18:31:31Z",
  "published": "2026-09-04T18:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18076"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7285844"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PCPM-W6GC-FM98

Vulnerability from github – Published: 2025-09-18 18:30 – Updated: 2025-12-12 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register()

mhi_alloc_controller() allocates a memory space for mhi_ctrl. When gets some error, mhi_ctrl should be freed with mhi_free_controller(). But when ath11k_mhi_read_addr_from_dt() fails, the function returns without calling mhi_free_controller(), which will lead to a memory leak.

We can fix it by calling mhi_free_controller() when ath11k_mhi_read_addr_from_dt() fails.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-50418"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-18T16:15:45Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register()\n\nmhi_alloc_controller() allocates a memory space for mhi_ctrl. When gets\nsome error, mhi_ctrl should be freed with mhi_free_controller(). But\nwhen ath11k_mhi_read_addr_from_dt() fails, the function returns without\ncalling mhi_free_controller(), which will lead to a memory leak.\n\nWe can fix it by calling mhi_free_controller() when\nath11k_mhi_read_addr_from_dt() fails.",
  "id": "GHSA-pcpm-w6gc-fm98",
  "modified": "2025-12-12T21:31:31Z",
  "published": "2025-09-18T18:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50418"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/015ced9eb63b8b19cb725a1d592d150b60494ced"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/43e7c3505ec70db3d3c6458824d5fa40f62e3e7b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/72ef896e80b6ec7cdc1dd42577045f8e7c9c32b3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PCVH-VV8G-JM39

Vulnerability from github – Published: 2022-08-05 00:00 – Updated: 2022-08-11 00:00

Details

The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of service, and information disclosure by invoking the function TEE_PopulateTransientObject with a large number in the parameter attrCount.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-35858"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-04T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of service, and information disclosure by invoking the function TEE_PopulateTransientObject with a large number in the parameter attrCount.",
  "id": "GHSA-pcvh-vv8g-jm39",
  "modified": "2022-08-11T00:00:32Z",
  "published": "2022-08-05T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35858"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Samsung/mTower/issues/71"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/lib/libutee/tee_api_objects.c#L283"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PFJ6-PXH2-F24M

Vulnerability from github – Published: 2024-05-17 15:31 – Updated: 2024-11-07 00:30

Details

In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: qseecom: fix memory leaks in error paths

Fix instances of returning error codes directly instead of jumping to the relevant labels where memory allocated for the SCM calls would be freed.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-52684"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-17T15:15:19Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: qseecom: fix memory leaks in error paths\n\nFix instances of returning error codes directly instead of jumping to\nthe relevant labels where memory allocated for the SCM calls would be\nfreed.",
  "id": "GHSA-pfj6-pxh2-f24m",
  "modified": "2024-11-07T00:30:35Z",
  "published": "2024-05-17T15:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52684"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6c57d7b593c4a4e60db65d5ce0fe1d9f79ccbe9b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/85fdbf6840455be64eac16bdfe0df3368ee3d0f0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PFRQ-P4GG-QWX6

Vulnerability from github – Published: 2025-10-23 18:31 – Updated: 2025-10-23 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: thinkpad_acpi: Fix a memory leak of EFCH MMIO resource

Unlike release_mem_region(), a call to release_resource() does not free the resource, so it has to be freed explicitly to avoid a memory leak.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-49665"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:41Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: thinkpad_acpi: Fix a memory leak of EFCH MMIO resource\n\nUnlike release_mem_region(), a call to release_resource() does not\nfree the resource, so it has to be freed explicitly to avoid a memory\nleak.",
  "id": "GHSA-pfrq-p4gg-qwx6",
  "modified": "2025-10-23T18:31:05Z",
  "published": "2025-10-23T18:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49665"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3884bf75fa044c73e843d95dd71a424e80ebb095"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d2f33f0c3ad7b0d5262d9b986f1353265fad7a08"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PFV7-6GR3-PF99

Vulnerability from github – Published: 2024-11-07 12:30 – Updated: 2025-11-04 00:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()

The sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb in case of skb->len being too long, add dev_kfree_skb() to fix it.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-50168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-07T10:15:07Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sun3_82586: fix potential memory leak in sun3_82586_send_packet()\n\nThe sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb\nin case of skb-\u003elen being too long, add dev_kfree_skb() to fix it.",
  "id": "GHSA-pfv7-6gr3-pf99",
  "modified": "2025-11-04T00:31:57Z",
  "published": "2024-11-07T12:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50168"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/137010d26dc5cd47cd62fef77cbe952d31951b7a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1a17a4ac2d57102497fac53b53c666dba6a0c20d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2cb3f56e827abb22c4168ad0c1bbbf401bb2f3b8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6dc937a3086e344f965ca5c459f8f3eb6b68d890"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/84f2bac74000dbb7a177d9b98a17031ec8d07ec5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8d5b20fbc548650019afa96822b6a33ea4ec8aa5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9c6ce55e6f0bd1541f112833006b4052614c7d94"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/db755e55349045375c5c7036e8650afb3ff419d8"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CWE-401

Missing Release of Memory after Effective Lifetime

GHSA-P9JM-Q85P-7MCP

Summary

Technical Details

PoC

Impact

Suggested Fix

Affected Package/Versions

Advisory History

Why This Is Not Intended Behavior

GHSA-PC3Q-7XFR-H5H3

GHSA-PC3V-MPGJ-WXWQ

GHSA-PC8P-4PFJ-FGM2

GHSA-PC96-PG3P-MMM7

GHSA-PCPM-W6GC-FM98

GHSA-PCVH-VV8G-JM39

GHSA-PFJ6-PXH2-F24M

GHSA-PFRQ-P4GG-QWX6

GHSA-PFV7-6GR3-PF99

Mitigation MIT-41

Mitigation

Mitigation