CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2257 vulnerabilities reference this CWE, most recent first.
GHSA-2QM8-4J25-V4W6
Vulnerability from github – Published: 2024-02-05 18:31 – Updated: 2024-02-08 00:32gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function.
{
"affected": [],
"aliases": [
"CVE-2024-24265"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-05T18:15:52Z",
"severity": "HIGH"
},
"details": "gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function.",
"id": "GHSA-2qm8-4j25-v4w6",
"modified": "2024-02-08T00:32:19Z",
"published": "2024-02-05T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24265"
},
{
"type": "WEB",
"url": "https://github.com/yinluming13579/gpac_defects/blob/main/gpac_1.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2QM9-92XG-CR8H
Vulnerability from github – Published: 2024-05-21 18:31 – Updated: 2025-09-23 21:30In the Linux kernel, the following vulnerability has been resolved:
media: imon: fix access to invalid resource for the second interface
imon driver probes two USB interfaces, and at the probe of the second interface, the driver assumes blindly that the first interface got bound with the same imon driver. It's usually true, but it's still possible that the first interface is bound with another driver via a malformed descriptor. Then it may lead to a memory corruption, as spotted by syzkaller; imon driver accesses the data from drvdata as struct imon_context object although it's a completely different one that was assigned by another driver.
This patch adds a sanity check -- whether the first interface is really bound with the imon driver or not -- for avoiding the problem above at the probe time.
{
"affected": [],
"aliases": [
"CVE-2023-52754"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T16:15:14Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imon: fix access to invalid resource for the second interface\n\nimon driver probes two USB interfaces, and at the probe of the second\ninterface, the driver assumes blindly that the first interface got\nbound with the same imon driver. It\u0027s usually true, but it\u0027s still\npossible that the first interface is bound with another driver via a\nmalformed descriptor. Then it may lead to a memory corruption, as\nspotted by syzkaller; imon driver accesses the data from drvdata as\nstruct imon_context object although it\u0027s a completely different one\nthat was assigned by another driver.\n\nThis patch adds a sanity check -- whether the first interface is\nreally bound with the imon driver or not -- for avoiding the problem\nabove at the probe time.",
"id": "GHSA-2qm9-92xg-cr8h",
"modified": "2025-09-23T21:30:53Z",
"published": "2024-05-21T18:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52754"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0f5068519f89d928d6c51100e4b274479123829f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/10ec5a97f8f5a772a1a42b4eb27196b447cd3aa9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2a493a34bd6e496c55fabedd82b957193ace178f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5e0b788fb96be36d1baf1a5c88d09c7c82a0452a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a1766a4fd83befa0b34d932d532e7ebb7fab1fa7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b083aaf5db2eeca9e362723258e5d8698f7dd84e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2QP4-WWRV-GF4C
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.
{
"affected": [],
"aliases": [
"CVE-2020-22037"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-01T20:15:00Z",
"severity": "MODERATE"
},
"details": "A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.",
"id": "GHSA-2qp4-wwrv-gf4c",
"modified": "2022-05-24T19:03:40Z",
"published": "2022-05-24T19:03:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22037"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html"
},
{
"type": "WEB",
"url": "https://trac.ffmpeg.org/ticket/8281"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4990"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4998"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2R25-QJCV-HR44
Vulnerability from github – Published: 2026-07-19 12:30 – Updated: 2026-07-29 18:31In the Linux kernel, the following vulnerability has been resolved:
drm/colorop: Fix blob property reference tracking in state lifecycle
The colorop state blob property handling had memory leaks during state duplication, destruction, and reset operations. The implementation failed to follow the established pattern from drm_crtc's handling of DEGAMMA/GAMMA blob properties.
Issues fixed: - drm_colorop_atomic_destroy_state() was freeing state memory without releasing the blob reference, causing a leak - drm_colorop_reset() was directly freeing old state with kfree() instead of properly destroying it, leaking blob references - drm_colorop_cleanup() had duplicate blob cleanup code
Changes: - Add __drm_atomic_helper_colorop_destroy_state() helper to properly release blob references before freeing state memory - Update drm_colorop_atomic_destroy_state() to call the helper - Fix drm_colorop_reset() to use drm_colorop_atomic_destroy_state() for proper cleanup of old state - Simplify drm_colorop_cleanup() to use the common destruction path
This matches the well-tested pattern used by drm_crtc since 2016 and ensures proper reference counting throughout the state lifecycle.
Co-developed by Claude Sonnet 4.5.
{
"affected": [],
"aliases": [
"CVE-2026-53378"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T11:16:38Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/colorop: Fix blob property reference tracking in state lifecycle\n\nThe colorop state blob property handling had memory leaks during state\nduplication, destruction, and reset operations. The implementation\nfailed to follow the established pattern from drm_crtc\u0027s handling of\nDEGAMMA/GAMMA blob properties.\n\nIssues fixed:\n- drm_colorop_atomic_destroy_state() was freeing state memory without\n releasing the blob reference, causing a leak\n- drm_colorop_reset() was directly freeing old state with kfree()\n instead of properly destroying it, leaking blob references\n- drm_colorop_cleanup() had duplicate blob cleanup code\n\nChanges:\n- Add __drm_atomic_helper_colorop_destroy_state() helper to properly\n release blob references before freeing state memory\n- Update drm_colorop_atomic_destroy_state() to call the helper\n- Fix drm_colorop_reset() to use drm_colorop_atomic_destroy_state()\n for proper cleanup of old state\n- Simplify drm_colorop_cleanup() to use the common destruction path\n\nThis matches the well-tested pattern used by drm_crtc since 2016 and\nensures proper reference counting throughout the state lifecycle.\n\nCo-developed by Claude Sonnet 4.5.",
"id": "GHSA-2r25-qjcv-hr44",
"modified": "2026-07-29T18:31:31Z",
"published": "2026-07-19T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53378"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/235b333e2878d791cee09e1e72f44611a9400114"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/271059f1d9020e9ac967524e319fbbaa22d0475b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2R2X-3JH4-CHHV
Vulnerability from github – Published: 2024-05-22 09:31 – Updated: 2025-11-03 18:31In the Linux kernel, the following vulnerability has been resolved:
ptp: Fix possible memory leak in ptp_clock_register()
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff88800906c618 (size 8): comm "i2c-idt82p33931", pid 4421, jiffies 4294948083 (age 13.188s) hex dump (first 8 bytes): 70 74 70 30 00 00 00 00 ptp0.... backtrace: [<00000000312ed458>] __kmalloc_track_caller+0x19f/0x3a0 [<0000000079f6e2ff>] kvasprintf+0xb5/0x150 [<0000000026aae54f>] kvasprintf_const+0x60/0x190 [<00000000f323a5f7>] kobject_set_name_vargs+0x56/0x150 [<000000004e35abdd>] dev_set_name+0xc0/0x100 [<00000000f20cfe25>] ptp_clock_register+0x9f4/0xd30 [ptp] [<000000008bb9f0de>] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]
When posix_clock_register() returns an error, the name allocated in dev_set_name() will be leaked, the put_device() should be used to give up the device reference, then the name will be freed in kobject_cleanup() and other memory will be freed in ptp_clock_release().
{
"affected": [],
"aliases": [
"CVE-2021-47455"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T07:15:10Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: Fix possible memory leak in ptp_clock_register()\n\nI got memory leak as follows when doing fault injection test:\n\nunreferenced object 0xffff88800906c618 (size 8):\n comm \"i2c-idt82p33931\", pid 4421, jiffies 4294948083 (age 13.188s)\n hex dump (first 8 bytes):\n 70 74 70 30 00 00 00 00 ptp0....\n backtrace:\n [\u003c00000000312ed458\u003e] __kmalloc_track_caller+0x19f/0x3a0\n [\u003c0000000079f6e2ff\u003e] kvasprintf+0xb5/0x150\n [\u003c0000000026aae54f\u003e] kvasprintf_const+0x60/0x190\n [\u003c00000000f323a5f7\u003e] kobject_set_name_vargs+0x56/0x150\n [\u003c000000004e35abdd\u003e] dev_set_name+0xc0/0x100\n [\u003c00000000f20cfe25\u003e] ptp_clock_register+0x9f4/0xd30 [ptp]\n [\u003c000000008bb9f0de\u003e] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]\n\nWhen posix_clock_register() returns an error, the name allocated\nin dev_set_name() will be leaked, the put_device() should be used\nto give up the device reference, then the name will be freed in\nkobject_cleanup() and other memory will be freed in ptp_clock_release().",
"id": "GHSA-2r2x-3jh4-chhv",
"modified": "2025-11-03T18:31:14Z",
"published": "2024-05-22T09:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47455"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4225fea1cb28370086e17e82c0f69bec2779dca0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/95c0a0c5ec8839f8f21672be786e87a100319ca8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f1c96d8085588e1b997a96214b409ac3be20b524"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2R3R-854P-XJFR
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.
{
"affected": [],
"aliases": [
"CVE-2010-2249"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-06-30T18:30:00Z",
"severity": "MODERATE"
},
"details": "Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.",
"id": "GHSA-2r3r-854p-xjfr",
"modified": "2022-05-13T01:23:34Z",
"published": "2022-05-13T01:23:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2249"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0534"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2010-2249"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=608644"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59816"
},
{
"type": "WEB",
"url": "http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commitdiff%3Bh=90cfcecc09febb8d6c8c1d37ea7bb7cf0f4b00f3#patch20"
},
{
"type": "WEB",
"url": "http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=90cfcecc09febb8d6c8c1d37ea7bb7cf0f4b00f3#patch20"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044283.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044397.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html"
},
{
"type": "WEB",
"url": "http://lists.vmware.com/pipermail/security-announce/2010/000105.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/40302"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/40336"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/40472"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/40547"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/41574"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42314"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42317"
},
{
"type": "WEB",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2010\u0026m=slackware-security.613061"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4435"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4456"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4457"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4554"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4566"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2010/dsa-2072"
},
{
"type": "WEB",
"url": "http://www.libpng.org/pub/png/libpng.html"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:133"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/41174"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1024723"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-960-1"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2010-0014.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1612"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1637"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1755"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1837"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1846"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1877"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/2491"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/3045"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/3046"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2RCM-PHC9-3945
Vulnerability from github – Published: 2018-10-10 16:10 – Updated: 2024-10-21 21:06It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS #12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service.
This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection that would cause the calling application to reload certificates from a PKCS #12 store. This vulnerability appears to have been fixed in 17.5.0.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pyopenssl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "17.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000808"
],
"database_specific": {
"cwe_ids": [
"CWE-401",
"CWE-404"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:52:58Z",
"nvd_published_at": "2018-10-08T15:29:00Z",
"severity": "HIGH"
},
"details": "It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS #12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service.\n\nThis attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection that would cause the calling application to reload certificates from a PKCS #12 store. This vulnerability appears to have been fixed in 17.5.0.",
"id": "GHSA-2rcm-phc9-3945",
"modified": "2024-10-21T21:06:54Z",
"published": "2018-10-10T16:10:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000808"
},
{
"type": "WEB",
"url": "https://github.com/pyca/pyopenssl/pull/723"
},
{
"type": "WEB",
"url": "https://github.com/pyca/pyopenssl/commit/e73818600065821d588af475b024f4eb518c3509"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:0085"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-2rcm-phc9-3945"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyca/pyopenssl"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyopenssl/PYSEC-2018-24.yaml"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3813-1"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Pyopenssl Incorrect Memory Management"
}
GHSA-2RM3-QP6X-WXFH
Vulnerability from github – Published: 2026-09-24 18:31 – Updated: 2026-10-06 18:31Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.
{
"affected": [],
"aliases": [
"CVE-2026-88385"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-24T17:17:08Z",
"severity": "MODERATE"
},
"details": "Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.",
"id": "GHSA-2rm3-qp6x-wxfh",
"modified": "2026-10-06T18:31:20Z",
"published": "2026-09-24T18:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88385"
},
{
"type": "WEB",
"url": "https://github.com/michaelrsweet/mxml/issues/356"
},
{
"type": "WEB",
"url": "https://github.com/michaelrsweet/mxml/commit/83ef80ae3c5413b73f501edb59ee74e31ce399d0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2VGM-JH3H-JPGG
Vulnerability from github – Published: 2026-05-01 15:30 – Updated: 2026-05-08 18:31In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: mpu3050: Fix irq resource leak
The interrupt handler is setup but only a few lines down if iio_trigger_register() fails the function returns without properly releasing the handler.
Add cleanup goto to resolve resource leak.
Detected by Smatch: drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn: 'irq' from request_threaded_irq() not released on lines: 1124.
{
"affected": [],
"aliases": [
"CVE-2026-31762"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-01T15:16:39Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Fix irq resource leak\n\nThe interrupt handler is setup but only a few lines down if\niio_trigger_register() fails the function returns without properly\nreleasing the handler.\n\nAdd cleanup goto to resolve resource leak.\n\nDetected by Smatch:\ndrivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:\n\u0027irq\u0027 from request_threaded_irq() not released on lines: 1124.",
"id": "GHSA-2vgm-jh3h-jpgg",
"modified": "2026-05-08T18:31:26Z",
"published": "2026-05-01T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31762"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3a8e68d65a443de05061818823037931674740e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4216db1043a3be72ef9c2b7b9f393d7fa72496e6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/658d9deb45d5032baf388ac51991d1e789157334"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/889253494ec73d60bd47c0518f8fe3a748520d5b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8f237c408f3007d7d9667623ffb41a9e9d661ee9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b52fd1644ad2c4e96bbec97543a966d7ad8f21ea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/beb23092571e627190f23da4bb8548065cacd89c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e66215fc1878357d5c980066e650f542330524af"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2VH6-G7PQ-9FGV
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-06-11 03:30In the Linux kernel, the following vulnerability has been resolved:
pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
The hdr variable is allocated on the stack and only hdr.version and hdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr contains reserved padding bytes (reserved[3] and reserved2[40]), these could leak the uninitialized bytes to userspace after copy_to_user().
This patch fixes that by initializing the whole struct to 0.
{
"affected": [],
"aliases": [
"CVE-2026-46182"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:33Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npseries/papr-hvpipe: Prevent kernel stack memory leak to userspace\n\nThe hdr variable is allocated on the stack and only hdr.version and\nhdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr\ncontains reserved padding bytes (reserved[3] and reserved2[40]), these\ncould leak the uninitialized bytes to userspace after copy_to_user().\n\nThis patch fixes that by initializing the whole struct to 0.",
"id": "GHSA-2vh6-g7pq-9fgv",
"modified": "2026-06-11T03:30:23Z",
"published": "2026-05-28T12:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46182"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0479b6e9f999cc1cbad7d9f09f574fc387e605d5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cefeed44296261173a806bef988b26bc565da4be"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f88f8e4485b437e0a2f96a7ff1f88aa22d925659"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.