Common Weakness Enumeration

CWE-401

Allowed

Missing Release of Memory after Effective Lifetime

Abstraction: Variant · Status: Draft

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

2091 vulnerabilities reference this CWE, most recent first.

GHSA-28J2-GR4P-P982

Vulnerability from github – Published: 2024-05-22 09:31 – Updated: 2025-01-07 21:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()

Commit 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()"), intended to change:

    bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN


    bsg_job->request->msgcode != FC_BSG_RPT_ELS

but changed it to:

    bsg_job->request->msgcode == FC_BSG_RPT_ELS

instead.

Change the == to a != to avoid leaking the fcport structure or freeing unallocated memory.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2021-47473"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-22T07:15:12Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()\n\nCommit 8c0eb596baa5 (\"[SCSI] qla2xxx: Fix a memory leak in an error path of\nqla2x00_process_els()\"), intended to change:\n\n        bsg_job-\u003erequest-\u003emsgcode == FC_BSG_HST_ELS_NOLOGIN\n\n\n        bsg_job-\u003erequest-\u003emsgcode != FC_BSG_RPT_ELS\n\nbut changed it to:\n\n        bsg_job-\u003erequest-\u003emsgcode == FC_BSG_RPT_ELS\n\ninstead.\n\nChange the == to a != to avoid leaking the fcport structure or freeing\nunallocated memory.",
  "id": "GHSA-28j2-gr4p-p982",
  "modified": "2025-01-07T21:30:54Z",
  "published": "2024-05-22T09:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47473"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7fb223d0ad801f633c78cbe42b1d1b55f5d163ad"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/96f0aebf29be25254fa585af43924e34aa21fd9a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a7fbb56e6c941d9f59437b96412a348e66388d3e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-28X7-22J7-WRCC

Vulnerability from github – Published: 2025-10-07 18:31 – Updated: 2026-02-04 00:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()

If 'mipid_detect()' fails, we must free 'md' to avoid a memory leak.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2023-53650"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-07T16:15:48Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()\n\nIf \u0027mipid_detect()\u0027 fails, we must free \u0027md\u0027 to avoid a memory leak.",
  "id": "GHSA-28x7-22j7-wrcc",
  "modified": "2026-02-04T00:30:28Z",
  "published": "2025-10-07T18:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53650"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/09ea1ae4a2ec17774892cfcff50f6d33dfa1e06f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3b4c21804076e461a6453ee4d09872172336aa1d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/716efd08985e3104031d1b655930b1f1c45fa8a7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/79a3908d1ea6c35157a6d907b1a9d8ec06015e7a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7a8f9293bee51183023c5e37e7ebf0543cd2a134"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7cca0af3167dd9603da5fa6fff3392f8338e97e1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9e3858f82e3ced1e990ef7116c3a16c84e62093e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ce6e0434e502abdf966164b7c72523fb5fe54635"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d97840bf5a388c6cbf6e46216887bf17be62acc2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-28XH-CHPH-8X29

Vulnerability from github – Published: 2024-07-10 09:30 – Updated: 2024-11-25 21:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: fix missing sk_buff release in seg6_input_core

The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak.

This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") and persists even after commit 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), where the entire seg6_input() code was refactored to deal with netfilter hooks.

The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2024-39490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-10T08:15:11Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix missing sk_buff release in seg6_input_core\n\nThe seg6_input() function is responsible for adding the SRH into a\npacket, delegating the operation to the seg6_input_core(). This function\nuses the skb_cow_head() to ensure that there is sufficient headroom in\nthe sk_buff for accommodating the link-layer header.\nIn the event that the skb_cow_header() function fails, the\nseg6_input_core() catches the error but it does not release the sk_buff,\nwhich will result in a memory leak.\n\nThis issue was introduced in commit af3b5158b89d (\"ipv6: sr: fix BUG due\nto headroom too small after SRH push\") and persists even after commit\n7a3f5b0de364 (\"netfilter: add netfilter hooks to SRv6 data plane\"),\nwhere the entire seg6_input() code was refactored to deal with netfilter\nhooks.\n\nThe proposed patch addresses the identified memory leak by requiring the\nseg6_input_core() function to release the sk_buff in the event that\nskb_cow_head() fails.",
  "id": "GHSA-28xh-chph-8x29",
  "modified": "2024-11-25T21:30:48Z",
  "published": "2024-07-10T09:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39490"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5447f9708d9e4c17a647b16a9cb29e9e02820bd9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8f1fc3b86eaea70be6abcae2e9aa7e7b99453864"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e8688218e38111ace457509d8f0cad75f79c1a7a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f4df8c7670a73752201cbde215254598efdf6ce8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f5fec1588642e415a3d72e02140160661b303940"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-299C-RWX7-XH4Q

Vulnerability from github – Published: 2025-06-18 12:30 – Updated: 2025-11-13 21:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: Fix a potential gpu_metrics_table memory leak

Memory is allocated for gpu_metrics_table in smu_v13_0_4_init_smc_tables(), but not freed in smu_v13_0_4_fini_smc_tables(). This may cause memory leaks, fix it.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2022-49971"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-18T11:15:24Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Fix a potential gpu_metrics_table memory leak\n\nMemory is allocated for gpu_metrics_table in\nsmu_v13_0_4_init_smc_tables(), but not freed in\nsmu_v13_0_4_fini_smc_tables(). This may cause memory leaks, fix it.",
  "id": "GHSA-299c-rwx7-xh4q",
  "modified": "2025-11-13T21:31:17Z",
  "published": "2025-06-18T12:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49971"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4b25bdb54578f3b96ff055e5d27bc1cb82950e51"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5afb76522a0af0513b6dc01f84128a73206b051b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-29C6-3HCJ-89CF

Vulnerability from github – Published: 2025-02-12 19:20 – Updated: 2025-02-12 19:20
VLAI
Summary
go-crypto-winnative BCryptGenerateSymmetricKey memory leak
Details

Calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time.

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/microsoft/go-crypto-winnative"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20250211154640-f49c8e1379ea"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-25199"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-12T19:20:24Z",
    "nvd_published_at": "2025-02-12T18:15:27Z",
    "severity": "HIGH"
  },
  "details": "Calls to `cng.TLS1PRF` don\u0027t release the key handle, producing a small memory leak every time.",
  "id": "GHSA-29c6-3hcj-89cf",
  "modified": "2025-02-12T19:20:24Z",
  "published": "2025-02-12T19:20:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/go-crypto-winnative/security/advisories/GHSA-29c6-3hcj-89cf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25199"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/go-crypto-winnative/commit/f49c8e1379ea4b147d5bff1b3be5b0ff45792e41"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/microsoft/go-crypto-winnative"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "go-crypto-winnative BCryptGenerateSymmetricKey memory leak"
}

GHSA-29H5-9G4G-X624

Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-06-16 15:33
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix memory leaks in rxkad_verify_response()

Fix rxkad_verify_response() to free the ticket and the server key under all circumstances by initialising the ticket pointer to NULL and then making all paths through the function after the first allocation has been done go through a single common epilogue that just releases everything - where all the releases skip on a NULL pointer.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-46012"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T14:17:19Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix memory leaks in rxkad_verify_response()\n\nFix rxkad_verify_response() to free the ticket and the server key under all\ncircumstances by initialising the ticket pointer to NULL and then making\nall paths through the function after the first allocation has been done go\nthrough a single common epilogue that just releases everything - where all\nthe releases skip on a NULL pointer.",
  "id": "GHSA-29h5-9g4g-x624",
  "modified": "2026-06-16T15:33:41Z",
  "published": "2026-05-27T15:33:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46012"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/34f61a07e0cdefaecd3ec03bb5fb22215643678f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/852b9d64cea421336579b2de3d1338dfa677e2dd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/861b9a0a1823bf064a7b810d29502a9ef043f40f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c4b8f32e73eafd4a5076be890c7c8506ec04567c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c91f33fb8356dedc82bc56ce210f1a5dbee62a52"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-29PG-6WGV-66X3

Vulnerability from github – Published: 2024-12-29 09:30 – Updated: 2025-11-03 21:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

ionic: Fix netdev notifier unregister on failure

If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure. This will also call ionic_lif_unregister_phc() if it has already been registered.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2024-56715"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T09:15:06Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nionic: Fix netdev notifier unregister on failure\n\nIf register_netdev() fails, then the driver leaks the netdev notifier.\nFix this by calling ionic_lif_unregister() on register_netdev()\nfailure. This will also call ionic_lif_unregister_phc() if it has\nalready been registered.",
  "id": "GHSA-29pg-6wgv-66x3",
  "modified": "2025-11-03T21:32:02Z",
  "published": "2024-12-29T09:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56715"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/87847938f5708b2509b279369c96572254bcf2ba"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9590d32e090ea2751e131ae5273859ca22f5ac14"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/da5736f516a664a9e1ff74902663c64c423045d2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/da93a12876f8b969df7316dc93aac7e725f88252"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ee2e931b2b46de9af7f681258e8ec8e2cd81cfc6"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2C3F-FWWH-C3V4

Vulnerability from github – Published: 2025-09-18 18:30 – Updated: 2025-12-11 15:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

objtool: Fix memory leak in create_static_call_sections()

strdup() allocates memory for key_name. We need to release the memory in the following error paths. Add free() to avoid memory leak.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2023-53423"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-18T16:15:46Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nobjtool: Fix memory leak in create_static_call_sections()\n\nstrdup() allocates memory for key_name. We need to release the memory in\nthe following error paths. Add free() to avoid memory leak.",
  "id": "GHSA-2c3f-fwwh-c3v4",
  "modified": "2025-12-11T15:30:30Z",
  "published": "2025-09-18T18:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53423"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3a75866a5ceff5d4fdd5471e06c4c4d03e0298b3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3da73f102309fe29150e5c35acd20dd82063ff67"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a1368eaea058e451d20ea99ca27e72d9df0d16dd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a8f63d747bf7c983882a5ea7456a5f84ad3acad5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d131718d9c45d559951f57c4b88209ca407433c4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2CFH-53W7-WVX4

Vulnerability from github – Published: 2025-03-14 00:30 – Updated: 2025-03-14 00:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

habanalabs: fix possible memory leak in MMU DR fini

This patch fixes what seems to be copy paste error.

We will have a memory leak if the host-resident shadow is NULL (which will likely happen as the DR and HR are not dependent).

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2022-49102"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:00:47Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix possible memory leak in MMU DR fini\n\nThis patch fixes what seems to be copy paste error.\n\nWe will have a memory leak if the host-resident shadow is NULL (which\nwill likely happen as the DR and HR are not dependent).",
  "id": "GHSA-2cfh-53w7-wvx4",
  "modified": "2025-03-14T00:30:48Z",
  "published": "2025-03-14T00:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49102"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/12e49aefda2e04b07604f13e03f40027cbeb0dc6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/30058d3a83cfe8c6aacbfe5ab13c01dd0c1799e3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6d421fb7a9eddd8ce0a05641a3db97283fe20699"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eb85eec858c1a5c11d3a0bff403f6440b05b40dc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2CHR-7VPH-93PF

Vulnerability from github – Published: 2026-02-14 18:30 – Updated: 2026-05-17 18:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix memory leak in set_ssp_complete

Fix memory leak in set_ssp_complete() where mgmt_pending_cmd structures are not freed after being removed from the pending list.

Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmt_pending_foreach() calls with individual command handling but missed adding mgmt_pending_free() calls in both error and success paths of set_ssp_complete(). Other completion functions like set_le_complete() were fixed correctly in the same commit.

This causes a memory leak of the mgmt_pending_cmd structure and its associated parameter data for each SSP command that completes.

Add the missing mgmt_pending_free(cmd) calls in both code paths to fix the memory leak. Also fix the same issue in set_advertising_complete().

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-23151"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-14T16:15:55Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix memory leak in set_ssp_complete\n\nFix memory leak in set_ssp_complete() where mgmt_pending_cmd structures\nare not freed after being removed from the pending list.\n\nCommit 302a1f674c00 (\"Bluetooth: MGMT: Fix possible UAFs\") replaced\nmgmt_pending_foreach() calls with individual command handling but missed\nadding mgmt_pending_free() calls in both error and success paths of\nset_ssp_complete(). Other completion functions like set_le_complete()\nwere fixed correctly in the same commit.\n\nThis causes a memory leak of the mgmt_pending_cmd structure and its\nassociated parameter data for each SSP command that completes.\n\nAdd the missing mgmt_pending_free(cmd) calls in both code paths to fix\nthe memory leak. Also fix the same issue in set_advertising_complete().",
  "id": "GHSA-2chr-7vph-93pf",
  "modified": "2026-05-17T18:30:26Z",
  "published": "2026-02-14T18:30:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23151"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1850a558d116d7e3e2ef36d06a56f59b640cc214"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3b6318505378828ee415d6ef678db6a74c077504"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d7e42dc47beb48851bc0008c1e1b79126de9d975"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation MIT-41
Implementation

Strategy: Libraries or Frameworks

  • Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
  • For example, glibc in Linux provides protection against free of invalid pointers.
  • When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
  • To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Architecture and Design

Use an abstraction library to abstract away risky APIs. Not a complete solution.

Mitigation
Architecture and Design Build and Compilation

Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

No CAPEC attack patterns related to this CWE.