CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2105 vulnerabilities reference this CWE, most recent first.
GHSA-8V6J-V3R3-P944
Vulnerability from github – Published: 2025-05-01 15:31 – Updated: 2025-11-07 21:31In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event()
test_gen_synth_cmd() only free buf in fail path, hence buf will leak when there is no failure. Add kfree(buf) to prevent the memleak. The same reason and solution in test_empty_synth_event().
unreferenced object 0xffff8881127de000 (size 2048): comm "modprobe", pid 247, jiffies 4294972316 (age 78.756s) hex dump (first 32 bytes): 20 67 65 6e 5f 73 79 6e 74 68 5f 74 65 73 74 20 gen_synth_test 20 70 69 64 5f 74 20 6e 65 78 74 5f 70 69 64 5f pid_t next_pid_ backtrace: [<000000004254801a>] kmalloc_trace+0x26/0x100 [<0000000039eb1cf5>] 0xffffffffa00083cd [<000000000e8c3bc8>] 0xffffffffa00086ba [<00000000c293d1ea>] do_one_initcall+0xdb/0x480 [<00000000aa189e6d>] do_init_module+0x1cf/0x680 [<00000000d513222b>] load_module+0x6a50/0x70a0 [<000000001fd4d529>] __do_sys_finit_module+0x12f/0x1c0 [<00000000b36c4c0f>] do_syscall_64+0x3f/0x90 [<00000000bbf20cf3>] entry_SYSCALL_64_after_hwframe+0x63/0xcd unreferenced object 0xffff8881127df000 (size 2048): comm "modprobe", pid 247, jiffies 4294972324 (age 78.728s) hex dump (first 32 bytes): 20 65 6d 70 74 79 5f 73 79 6e 74 68 5f 74 65 73 empty_synth_tes 74 20 20 70 69 64 5f 74 20 6e 65 78 74 5f 70 69 t pid_t next_pi backtrace: [<000000004254801a>] kmalloc_trace+0x26/0x100 [<00000000d4db9a3d>] 0xffffffffa0008071 [<00000000c31354a5>] 0xffffffffa00086ce [<00000000c293d1ea>] do_one_initcall+0xdb/0x480 [<00000000aa189e6d>] do_init_module+0x1cf/0x680 [<00000000d513222b>] load_module+0x6a50/0x70a0 [<000000001fd4d529>] __do_sys_finit_module+0x12f/0x1c0 [<00000000b36c4c0f>] do_syscall_64+0x3f/0x90 [<00000000bbf20cf3>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
{
"affected": [],
"aliases": [
"CVE-2022-49800"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T15:16:03Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event()\n\ntest_gen_synth_cmd() only free buf in fail path, hence buf will leak\nwhen there is no failure. Add kfree(buf) to prevent the memleak. The\nsame reason and solution in test_empty_synth_event().\n\nunreferenced object 0xffff8881127de000 (size 2048):\n comm \"modprobe\", pid 247, jiffies 4294972316 (age 78.756s)\n hex dump (first 32 bytes):\n 20 67 65 6e 5f 73 79 6e 74 68 5f 74 65 73 74 20 gen_synth_test\n 20 70 69 64 5f 74 20 6e 65 78 74 5f 70 69 64 5f pid_t next_pid_\n backtrace:\n [\u003c000000004254801a\u003e] kmalloc_trace+0x26/0x100\n [\u003c0000000039eb1cf5\u003e] 0xffffffffa00083cd\n [\u003c000000000e8c3bc8\u003e] 0xffffffffa00086ba\n [\u003c00000000c293d1ea\u003e] do_one_initcall+0xdb/0x480\n [\u003c00000000aa189e6d\u003e] do_init_module+0x1cf/0x680\n [\u003c00000000d513222b\u003e] load_module+0x6a50/0x70a0\n [\u003c000000001fd4d529\u003e] __do_sys_finit_module+0x12f/0x1c0\n [\u003c00000000b36c4c0f\u003e] do_syscall_64+0x3f/0x90\n [\u003c00000000bbf20cf3\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\nunreferenced object 0xffff8881127df000 (size 2048):\n comm \"modprobe\", pid 247, jiffies 4294972324 (age 78.728s)\n hex dump (first 32 bytes):\n 20 65 6d 70 74 79 5f 73 79 6e 74 68 5f 74 65 73 empty_synth_tes\n 74 20 20 70 69 64 5f 74 20 6e 65 78 74 5f 70 69 t pid_t next_pi\n backtrace:\n [\u003c000000004254801a\u003e] kmalloc_trace+0x26/0x100\n [\u003c00000000d4db9a3d\u003e] 0xffffffffa0008071\n [\u003c00000000c31354a5\u003e] 0xffffffffa00086ce\n [\u003c00000000c293d1ea\u003e] do_one_initcall+0xdb/0x480\n [\u003c00000000aa189e6d\u003e] do_init_module+0x1cf/0x680\n [\u003c00000000d513222b\u003e] load_module+0x6a50/0x70a0\n [\u003c000000001fd4d529\u003e] __do_sys_finit_module+0x12f/0x1c0\n [\u003c00000000b36c4c0f\u003e] do_syscall_64+0x3f/0x90\n [\u003c00000000bbf20cf3\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd",
"id": "GHSA-8v6j-v3r3-p944",
"modified": "2025-11-07T21:31:19Z",
"published": "2025-05-01T15:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49800"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/07ba4f0603aba288580866394f2916dfe55823a2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0e5baaa181a052d968701bb9c5b1d55847f00942"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/65ba7e7c241122ef0a9e61d1920f2ae9689aa796"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a4527fef9afe5c903c718d0cd24609fe9c754250"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8V7Q-6CGM-98QQ
Vulnerability from github – Published: 2025-05-01 15:31 – Updated: 2025-11-06 18:32In the Linux kernel, the following vulnerability has been resolved:
cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
In the for loop used to allocate the loc_array and bmap for each port, a memory leak is possible when the allocation for loc_array succeeds, but the allocation for bmap fails. This is because when the control flow goes to the label free_eth_finfo, only the allocations starting from (i-1)th iteration are freed.
Fix that by freeing the loc_array in the bmap allocation error path.
{
"affected": [],
"aliases": [
"CVE-2025-37788"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T14:15:43Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path\n\nIn the for loop used to allocate the loc_array and bmap for each port, a\nmemory leak is possible when the allocation for loc_array succeeds,\nbut the allocation for bmap fails. This is because when the control flow\ngoes to the label free_eth_finfo, only the allocations starting from\n(i-1)th iteration are freed.\n\nFix that by freeing the loc_array in the bmap allocation error path.",
"id": "GHSA-8v7q-6cgm-98qq",
"modified": "2025-11-06T18:32:43Z",
"published": "2025-05-01T15:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37788"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/00ffb3724ce743578163f5ade2884374554ca021"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/08aa59c0be768596467552c129e9f82166779a67"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/118d05b530343cd9322607b9719405ba254a4183"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/76deedea08899885f076aba0bb80bd1276446822"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dafb6e433ab2333b67be05433dc9c6ccbc7b1284"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e9de08e15aee35b96064960f95997bb6c1209c4b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fa2d7708955e4f8212fd69bab1da604e60cb0b15"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8VGM-MF5M-39HH
Vulnerability from github – Published: 2025-10-21 12:31 – Updated: 2025-10-21 12:31In the Linux kernel, the following vulnerability has been resolved:
rtw89: ser: fix CAM leaks occurring in L2 reset
The CAM, meaning address CAM and bssid CAM here, will get leaks during SER (system error recover) L2 reset process and ieee80211_restart_hw() which is called by L2 reset process eventually.
The normal flow would be like -> add interface (acquire 1) -> enter ips (release 1) -> leave ips (acquire 1) -> connection (occupy 1) <(A) 1 leak after L2 reset if non-sec connection>
The ieee80211_restart_hw() flow (under connection) -> ieee80211 reconfig -> add interface (acquire 1) -> leave ips (acquire 1) -> connection (occupy (A) + 2) <(B) 1 more leak>
Originally, CAM is released before HW restart only if connection is under security. Now, release CAM whatever connection it is to fix leak in (A). OTOH, check if CAM is already valid to avoid acquiring multiple times to fix (B).
Besides, if AP mode, release address CAM of all stations before HW restart.
{
"affected": [],
"aliases": [
"CVE-2022-49539"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:01:29Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtw89: ser: fix CAM leaks occurring in L2 reset\n\nThe CAM, meaning address CAM and bssid CAM here, will get leaks during\nSER (system error recover) L2 reset process and ieee80211_restart_hw()\nwhich is called by L2 reset process eventually.\n\nThe normal flow would be like\n-\u003e add interface (acquire 1)\n-\u003e enter ips (release 1)\n-\u003e leave ips (acquire 1)\n-\u003e connection (occupy 1) \u003c(A) 1 leak after L2 reset if non-sec connection\u003e\n\nThe ieee80211_restart_hw() flow (under connection)\n-\u003e ieee80211 reconfig\n-\u003e add interface (acquire 1)\n-\u003e leave ips (acquire 1)\n-\u003e connection (occupy (A) + 2) \u003c(B) 1 more leak\u003e\n\nOriginally, CAM is released before HW restart only if connection is under\nsecurity. Now, release CAM whatever connection it is to fix leak in (A).\nOTOH, check if CAM is already valid to avoid acquiring multiple times to\nfix (B).\n\nBesides, if AP mode, release address CAM of all stations before HW restart.",
"id": "GHSA-8vgm-mf5m-39hh",
"modified": "2025-10-21T12:31:26Z",
"published": "2025-10-21T12:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49539"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b169f877f001a474fb89939842c390518160bcc5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f6aff772c9978844529618d86aafb53e5d3ae161"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8W2Q-P4VP-8JXF
Vulnerability from github – Published: 2022-09-03 00:00 – Updated: 2022-09-09 00:01Potential memory leak in modem during the processing of NSA RRC Reconfiguration with invalid Radio Bearer Config in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
{
"affected": [],
"aliases": [
"CVE-2022-22067"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-02T12:15:00Z",
"severity": "HIGH"
},
"details": "Potential memory leak in modem during the processing of NSA RRC Reconfiguration with invalid Radio Bearer Config in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile",
"id": "GHSA-8w2q-p4vp-8jxf",
"modified": "2022-09-09T00:01:12Z",
"published": "2022-09-03T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22067"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/august-2022-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8W4C-RP37-3WMC
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-07-23 21:30In the Linux kernel, the following vulnerability has been resolved:
net_sched: fix skb memory leak in deferred qdisc drops
When the network stack cleans up the deferred list via qdisc_run_end(), it operates on the root qdisc. If the root qdisc do not implement the TCQ_F_DEQUEUE_DROPS flag the packets queue to free are never freed and gets stranded on the child's local to_free list.
Fix this by making qdisc_dequeue_drop() aware of the root qdisc. It fetches the root qdisc and check for the TCQ_F_DEQUEUE_DROPS flag. If the flag is present, the packet is appended directly to the root's to_free list. Otherwise, drop it directly as it was done before the optimization was implemented.
{
"affected": [],
"aliases": [
"CVE-2026-53079"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:21Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: fix skb memory leak in deferred qdisc drops\n\nWhen the network stack cleans up the deferred list via qdisc_run_end(),\nit operates on the root qdisc. If the root qdisc do not implement the\nTCQ_F_DEQUEUE_DROPS flag the packets queue to free are never freed and\ngets stranded on the child\u0027s local to_free list.\n\nFix this by making qdisc_dequeue_drop() aware of the root qdisc. It\nfetches the root qdisc and check for the TCQ_F_DEQUEUE_DROPS flag. If\nthe flag is present, the packet is appended directly to the root\u0027s\nto_free list. Otherwise, drop it directly as it was done before the\noptimization was implemented.",
"id": "GHSA-8w4c-rp37-3wmc",
"modified": "2026-07-23T21:30:32Z",
"published": "2026-06-24T18:32:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53079"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a6bd339dbb3514bce690fdcf252e788dfab4ee76"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bf26ad92ffda7884825d67b46bd5efe615c3babf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8W7F-4CRR-6CFR
Vulnerability from github – Published: 2024-05-21 18:31 – Updated: 2024-12-31 21:30In the Linux kernel, the following vulnerability has been resolved:
ice: switch: fix potential memleak in ice_add_adv_recipe()
When ice_add_special_words() fails, the 'rm' is not released, which will lead to a memory leak. Fix this up by going to 'err_unroll' label.
Compile tested only.
{
"affected": [],
"aliases": [
"CVE-2022-48709"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T16:15:12Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: switch: fix potential memleak in ice_add_adv_recipe()\n\nWhen ice_add_special_words() fails, the \u0027rm\u0027 is not released, which will\nlead to a memory leak. Fix this up by going to \u0027err_unroll\u0027 label.\n\nCompile tested only.",
"id": "GHSA-8w7f-4crr-6cfr",
"modified": "2024-12-31T21:30:44Z",
"published": "2024-05-21T18:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48709"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/47f4ff6f23f00f5501ff2d7054c1a37c170a7aa0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4a606ce68426c88ff2563382b33cc34f3485fe57"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WWJ-VQ54-XQWW
Vulnerability from github – Published: 2024-01-18 21:30 – Updated: 2024-01-25 03:30A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token function in the modules/preprocs/nasm/nasm-pp:1512.
{
"affected": [],
"aliases": [
"CVE-2023-51258"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-18T21:15:08Z",
"severity": "MODERATE"
},
"details": "A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token function in the modules/preprocs/nasm/nasm-pp:1512.",
"id": "GHSA-8wwj-vq54-xqww",
"modified": "2024-01-25T03:30:58Z",
"published": "2024-01-18T21:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51258"
},
{
"type": "WEB",
"url": "https://github.com/hanxuer/crashes/blob/main/yasm/04/readme.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8X83-FQ4G-V5M7
Vulnerability from github – Published: 2022-10-17 12:00 – Updated: 2022-10-19 12:00A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.
{
"affected": [],
"aliases": [
"CVE-2022-3533"
],
"database_specific": {
"cwe_ids": [
"CWE-401",
"CWE-404"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-17T09:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.",
"id": "GHSA-8x83-fq4g-v5m7",
"modified": "2022-10-19T12:00:20Z",
"published": "2022-10-17T12:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3533"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0dc9254e03704c75f2ebc9cbef2ce4de83fba603"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.211031"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8XHW-C2PC-2VQQ
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-06-01 18:31In the Linux kernel, the following vulnerability has been resolved:
xfrm_user: fix info leak in build_mapping()
struct xfrm_usersa_id has a one-byte padding hole after the proto field, which ends up never getting set to zero before copying out to userspace. Fix that up by zeroing out the whole structure before setting individual variables.
{
"affected": [],
"aliases": [
"CVE-2026-43089"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T10:16:22Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_mapping()\n\nstruct xfrm_usersa_id has a one-byte padding hole after the proto\nfield, which ends up never getting set to zero before copying out to\nuserspace. Fix that up by zeroing out the whole structure before\nsetting individual variables.",
"id": "GHSA-8xhw-c2pc-2vqq",
"modified": "2026-06-01T18:31:29Z",
"published": "2026-05-06T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43089"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1beb76b2053b68c491b78370794b8ff63c8f8c02"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/521385cbd50ca9474396d88462fcdfa6489685d9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5a1a4b049ddde41466ccac0daeec326254b133f2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/700c9622b23c33b5933e6dcea816492c064e4e10"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/72a8de41c3eb4dcf22bf3b674ea38fb2f75d6f32"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c2779ae9a3e5a044e5ccd564681511bbbcc5fc0f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d3125c541a96fb3c0fc7210112684baf22b6c24d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f779a6b6cdb6e12baa0663063ac59ab2a8f20c0c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8XVQ-Q955-PV4G
Vulnerability from github – Published: 2025-05-01 15:31 – Updated: 2025-11-03 15:30In the Linux kernel, the following vulnerability has been resolved:
iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
dev_set_name() allocates memory for name, it need be freed when device_add() fails, call put_device() to give up the reference that hold in device_initialize(), so that it can be freed in kobject_cleanup() when the refcount hit to 0.
Fault injection test can trigger this:
unreferenced object 0xffff8e8340a7b4c0 (size 32): comm "modprobe", pid 243, jiffies 4294678145 (age 48.845s) hex dump (first 32 bytes): 69 69 6f 5f 73 79 73 66 73 5f 74 72 69 67 67 65 iio_sysfs_trigge 72 00 a7 40 83 8e ff ff 00 86 13 c4 f6 ee ff ff r..@............ backtrace: [<0000000074999de8>] __kmem_cache_alloc_node+0x1e9/0x360 [<00000000497fd30b>] __kmalloc_node_track_caller+0x44/0x1a0 [<000000003636c520>] kstrdup+0x2d/0x60 [<0000000032f84da2>] kobject_set_name_vargs+0x1e/0x90 [<0000000092efe493>] dev_set_name+0x4e/0x70
{
"affected": [],
"aliases": [
"CVE-2022-49793"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T15:16:02Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()\n\ndev_set_name() allocates memory for name, it need be freed\nwhen device_add() fails, call put_device() to give up the\nreference that hold in device_initialize(), so that it can\nbe freed in kobject_cleanup() when the refcount hit to 0.\n\nFault injection test can trigger this:\n\nunreferenced object 0xffff8e8340a7b4c0 (size 32):\n comm \"modprobe\", pid 243, jiffies 4294678145 (age 48.845s)\n hex dump (first 32 bytes):\n 69 69 6f 5f 73 79 73 66 73 5f 74 72 69 67 67 65 iio_sysfs_trigge\n 72 00 a7 40 83 8e ff ff 00 86 13 c4 f6 ee ff ff r..@............\n backtrace:\n [\u003c0000000074999de8\u003e] __kmem_cache_alloc_node+0x1e9/0x360\n [\u003c00000000497fd30b\u003e] __kmalloc_node_track_caller+0x44/0x1a0\n [\u003c000000003636c520\u003e] kstrdup+0x2d/0x60\n [\u003c0000000032f84da2\u003e] kobject_set_name_vargs+0x1e/0x90\n [\u003c0000000092efe493\u003e] dev_set_name+0x4e/0x70",
"id": "GHSA-8xvq-q955-pv4g",
"modified": "2025-11-03T15:30:27Z",
"published": "2025-05-01T15:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49793"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0dd52e141afde089304de470148d311b05c14564"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c4e65285bdea23fd36d2ff376006ac64db6f42e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5a39382aa5411d64b25a71516c2c7480aab13bb7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/656f670613662b6cc77aad14112db2803ad18fa8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8dddf2699da296c84205582aaead6b43dd7e8c4b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b47bb521961f027b4dcf8683337a7a1ba9e5ea1f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/efa17e90e1711bdb084e3954fa44afb6647331c0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f68c96821b61d2c71a35dbb8bf90c347fad624d9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.