CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2187 vulnerabilities reference this CWE, most recent first.
GHSA-5JV6-7953-598P
Vulnerability from github – Published: 2024-05-03 18:30 – Updated: 2024-10-30 18:30In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: fix memory leak when using debugfs_lookup()
When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up by properly calling dput().
{
"affected": [],
"aliases": [
"CVE-2022-48698"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T16:15:08Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix memory leak when using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time. Fix this up by properly\ncalling dput().",
"id": "GHSA-5jv6-7953-598p",
"modified": "2024-10-30T18:30:45Z",
"published": "2024-05-03T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48698"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3a6279d243cb035eaaff1450980b40cf19748f05"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/58acd2ebae034db3bacf38708f508fbd12ae2e54"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cbfac7fa491651c57926c99edeb7495c6c1aeac2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5JX6-M427-9P5P
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-06-28 09:31In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix strparser anchor skb leak on offload RX setup failure
When tls_set_device_offload_rx() fails at tls_dev_add(), the error path calls tls_sw_free_resources_rx() to clean up the SW context that was initialized by tls_set_sw_offload(). This function calls tls_sw_release_resources_rx() (which stops the strparser via tls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context), but never frees the anchor skb that was allocated by alloc_skb(0) in tls_strp_init().
Note that tls_sw_free_resources_rx() is exclusively used for this "failed to start offload" code path, there's no other caller.
The leak did not exist before commit 84c61fe1a75b ("tls: rx: do not use the standard strparser"), because the standard strparser doesn't try to pre-allocate an skb.
The normal close path in tls_sk_proto_close() handles cleanup by calling tls_sw_strparser_done() (which calls tls_strp_done()) after dropping the socket lock, because tls_strp_done() does cancel_work_sync() and the strparser work handler takes the socket lock.
{
"affected": [],
"aliases": [
"CVE-2026-52974"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:07Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: fix strparser anchor skb leak on offload RX setup failure\n\nWhen tls_set_device_offload_rx() fails at tls_dev_add(), the error path\ncalls tls_sw_free_resources_rx() to clean up the SW context that was\ninitialized by tls_set_sw_offload(). This function calls\ntls_sw_release_resources_rx() (which stops the strparser via\ntls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context),\nbut never frees the anchor skb that was allocated by alloc_skb(0) in\ntls_strp_init().\n\nNote that tls_sw_free_resources_rx() is exclusively used for this\n\"failed to start offload\" code path, there\u0027s no other caller.\n\nThe leak did not exist before commit 84c61fe1a75b (\"tls: rx: do not use\nthe standard strparser\"), because the standard strparser doesn\u0027t try\nto pre-allocate an skb.\n\nThe normal close path in tls_sk_proto_close() handles cleanup by calling\ntls_sw_strparser_done() (which calls tls_strp_done()) after dropping\nthe socket lock, because tls_strp_done() does cancel_work_sync() and\nthe strparser work handler takes the socket lock.",
"id": "GHSA-5jx6-m427-9p5p",
"modified": "2026-06-28T09:31:37Z",
"published": "2026-06-24T18:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52974"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0c9f399b37ce22a5ed94cc51f03ed07ac7f38e32"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3c405dfa9619e506e75b8e41f8b29a5b99731877"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/58689498ca3384851145a754dbb1d8ed1cf9fb54"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/688f12aa44511dd57e448eb670075c6302ad1dc1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9c54e76f8d6eb11735918777ef0e0509e089557d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bd07fe6c38b9e44ff3fc02692a53f095c5cc9afc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5M92-7XMP-8C44
Vulnerability from github – Published: 2023-08-22 21:30 – Updated: 2024-04-04 07:07An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.
{
"affected": [],
"aliases": [
"CVE-2022-47010"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-22T19:16:30Z",
"severity": "MODERATE"
},
"details": "An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.",
"id": "GHSA-5m92-7xmp-8c44",
"modified": "2024-04-04T07:07:37Z",
"published": "2023-08-22T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47010"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=29262"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5MG2-XWPP-QVMQ
Vulnerability from github – Published: 2024-05-01 15:30 – Updated: 2024-12-23 15:30In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
If nft_netdev_register_hooks() fails, the memory associated with nft_stats is not freed, causing a memory leak.
This patch fixes it by moving nft_stats_alloc() down after nft_netdev_register_hooks() succeeds.
{
"affected": [],
"aliases": [
"CVE-2024-27064"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-01T13:15:50Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: Fix a memory leak in nf_tables_updchain\n\nIf nft_netdev_register_hooks() fails, the memory associated with\nnft_stats is not freed, causing a memory leak.\n\nThis patch fixes it by moving nft_stats_alloc() down after\nnft_netdev_register_hooks() succeeds.",
"id": "GHSA-5mg2-xwpp-qvmq",
"modified": "2024-12-23T15:30:47Z",
"published": "2024-05-01T15:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27064"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4e4623a4f6e133e671f65f9ac493bddaaf63e250"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/79846fdcc548d617b0b321addc6a3821d3b75b20"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7eaf837a4eb5f74561e2486972e7f5184b613f6e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e77a6b53a3a547b6dedfc40c37cee4f310701090"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5MPR-R2XV-9QFH
Vulnerability from github – Published: 2025-03-17 18:31 – Updated: 2025-03-17 18:31In the Linux kernel, the following vulnerability has been resolved:
drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo needs to be put when msm_gem_get_and_pin_iova fails.
{
"affected": [],
"aliases": [
"CVE-2022-49467"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:01:22Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: msm: fix possible memory leak in mdp5_crtc_cursor_set()\n\ndrm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo\nneeds to be put when msm_gem_get_and_pin_iova fails.",
"id": "GHSA-5mpr-r2xv-9qfh",
"modified": "2025-03-17T18:31:50Z",
"published": "2025-03-17T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49467"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/33546183c16c7b9650682dc610bedd732d9c6919"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/449374565f349d4233beec811d4286fdfe5de44b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/656aa3c51fc662064f17179b38ec3ce43af53bca"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/947a844bb3ebff0f4736d244d792ce129f6700d7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d544880482a5558ec06393b1b3d5dc9275b7a32b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d63ffe3fb3f8327ca21cf91b6a14a2961bc629b4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f8cd192752a1f613b14eee77783c6f0aebb49691"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5MRQ-2J6G-H4PF
Vulnerability from github – Published: 2025-08-11 06:30 – Updated: 2025-08-11 06:30in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
{
"affected": [],
"aliases": [
"CVE-2025-24925"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-11T04:15:34Z",
"severity": "LOW"
},
"details": "in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.",
"id": "GHSA-5mrq-2j6g-h4pf",
"modified": "2025-08-11T06:30:30Z",
"published": "2025-08-11T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24925"
},
{
"type": "WEB",
"url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5MVF-MW2H-9F35
Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2024-08-19 18:32In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix memory leak in __add_inode_ref()
Line 1169 (#3) allocates a memory chunk for victim_name by kmalloc(), but when the function returns in line 1184 (#4) victim_name allocated by line 1169 (#3) is not freed, which will lead to a memory leak. There is a similar snippet of code in this function as allocating a memory chunk for victim_name in line 1104 (#1) as well as releasing the memory in line 1116 (#2).
We should kfree() victim_name when the return value of backref_in_log() is less than zero and before the function returns in line 1184 (#4).
1057 static inline int __add_inode_ref(struct btrfs_trans_handle trans, 1058 struct btrfs_root root, 1059 struct btrfs_path path, 1060 struct btrfs_root log_root, 1061 struct btrfs_inode dir, 1062 struct btrfs_inode inode, 1063 u64 inode_objectid, u64 parent_objectid, 1064 u64 ref_index, char name, int namelen, 1065 int search_done) 1066 {
1104 victim_name = kmalloc(victim_name_len, GFP_NOFS); // #1: kmalloc (victim_name-1) 1105 if (!victim_name) 1106 return -ENOMEM;
1112 ret = backref_in_log(log_root, &search_key, 1113 parent_objectid, victim_name, 1114 victim_name_len); 1115 if (ret < 0) { 1116 kfree(victim_name); // #2: kfree (victim_name-1) 1117 return ret; 1118 } else if (!ret) {
1169 victim_name = kmalloc(victim_name_len, GFP_NOFS); // #3: kmalloc (victim_name-2) 1170 if (!victim_name) 1171 return -ENOMEM;
1180 ret = backref_in_log(log_root, &search_key, 1181 parent_objectid, victim_name, 1182 victim_name_len); 1183 if (ret < 0) { 1184 return ret; // #4: missing kfree (victim_name-2) 1185 } else if (!ret) {
1241 return 0; 1242 }
{
"affected": [],
"aliases": [
"CVE-2021-47585"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T15:15:53Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory leak in __add_inode_ref()\n\nLine 1169 (#3) allocates a memory chunk for victim_name by kmalloc(),\nbut when the function returns in line 1184 (#4) victim_name allocated\nby line 1169 (#3) is not freed, which will lead to a memory leak.\nThere is a similar snippet of code in this function as allocating a memory\nchunk for victim_name in line 1104 (#1) as well as releasing the memory\nin line 1116 (#2).\n\nWe should kfree() victim_name when the return value of backref_in_log()\nis less than zero and before the function returns in line 1184 (#4).\n\n1057 static inline int __add_inode_ref(struct btrfs_trans_handle *trans,\n1058 \t\t\t\t struct btrfs_root *root,\n1059 \t\t\t\t struct btrfs_path *path,\n1060 \t\t\t\t struct btrfs_root *log_root,\n1061 \t\t\t\t struct btrfs_inode *dir,\n1062 \t\t\t\t struct btrfs_inode *inode,\n1063 \t\t\t\t u64 inode_objectid, u64 parent_objectid,\n1064 \t\t\t\t u64 ref_index, char *name, int namelen,\n1065 \t\t\t\t int *search_done)\n1066 {\n\n1104 \tvictim_name = kmalloc(victim_name_len, GFP_NOFS);\n\t// #1: kmalloc (victim_name-1)\n1105 \tif (!victim_name)\n1106 \t\treturn -ENOMEM;\n\n1112\tret = backref_in_log(log_root, \u0026search_key,\n1113\t\t\tparent_objectid, victim_name,\n1114\t\t\tvictim_name_len);\n1115\tif (ret \u003c 0) {\n1116\t\tkfree(victim_name); // #2: kfree (victim_name-1)\n1117\t\treturn ret;\n1118\t} else if (!ret) {\n\n1169 \tvictim_name = kmalloc(victim_name_len, GFP_NOFS);\n\t// #3: kmalloc (victim_name-2)\n1170 \tif (!victim_name)\n1171 \t\treturn -ENOMEM;\n\n1180 \tret = backref_in_log(log_root, \u0026search_key,\n1181 \t\t\tparent_objectid, victim_name,\n1182 \t\t\tvictim_name_len);\n1183 \tif (ret \u003c 0) {\n1184 \t\treturn ret; // #4: missing kfree (victim_name-2)\n1185 \t} else if (!ret) {\n\n1241 \treturn 0;\n1242 }",
"id": "GHSA-5mvf-mw2h-9f35",
"modified": "2024-08-19T18:32:03Z",
"published": "2024-06-19T15:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47585"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/005d9292b5b2e71a009f911bd85d755009b37242"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/493ff661d434d6bdf02e3a21adae04d7a0b4265d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f35838a6930296fc1988764cfa54cb3f705c0665"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5MWP-XGJV-PJPH
Vulnerability from github – Published: 2026-09-04 12:30 – Updated: 2026-09-04 12:30Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resource leak exposure.
This issue affects smartLink HW-PN: from 1.04 before 1.10.
{
"affected": [],
"aliases": [
"CVE-2026-13148"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T10:17:10Z",
"severity": "MODERATE"
},
"details": "Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resource leak exposure.\n\nThis issue affects smartLink HW-PN: from 1.04 before 1.10.",
"id": "GHSA-5mwp-xgjv-pjph",
"modified": "2026-09-04T12:30:54Z",
"published": "2026-09-04T12:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13148"
},
{
"type": "WEB",
"url": "https://industrial.softing.com/fileadmin/psirt/downloads/2026/CVE-2026-13148.html"
},
{
"type": "WEB",
"url": "https://industrial.softing.com/fileadmin/psirt/downloads/2026/CVE-2026-13148.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:L/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-5MXP-4F79-C8G9
Vulnerability from github – Published: 2025-04-01 18:30 – Updated: 2025-10-31 18:31In the Linux kernel, the following vulnerability has been resolved:
netmem: prevent TX of unreadable skbs
Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the device's TX path, as the device may call dma-mapping APIs on dma addrs that should not be passed to it.
Fix this by preventing the xmit of unreadable skbs.
Tested by configuring tc redirect:
sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \ tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1
Before, I see unreadable skbs in the driver's TX path passed to dma mapping APIs.
After, I don't see unreadable skbs in the driver's TX path passed to dma mapping APIs.
{
"affected": [],
"aliases": [
"CVE-2025-21954"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:26Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetmem: prevent TX of unreadable skbs\n\nCurrently on stable trees we have support for netmem/devmem RX but not\nTX. It is not safe to forward/redirect an RX unreadable netmem packet\ninto the device\u0027s TX path, as the device may call dma-mapping APIs on\ndma addrs that should not be passed to it.\n\nFix this by preventing the xmit of unreadable skbs.\n\nTested by configuring tc redirect:\n\nsudo tc qdisc add dev eth1 ingress\nsudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \\\n\ttcp src_ip 192.168.1.12 action mirred egress redirect dev eth1\n\nBefore, I see unreadable skbs in the driver\u0027s TX path passed to dma\nmapping APIs.\n\nAfter, I don\u0027t see unreadable skbs in the driver\u0027s TX path passed to dma\nmapping APIs.",
"id": "GHSA-5mxp-4f79-c8g9",
"modified": "2025-10-31T18:31:11Z",
"published": "2025-04-01T18:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21954"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1c17c8ced25c5fbe424c7ad7ea11d33014a986b1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/454825019d2f0c59e5174ece9e713f45ad80beff"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f3600c867c99a2cc8038680ecf211089c50e7971"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5P3C-43QG-83MF
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-06-24 18:32In the Linux kernel, the following vulnerability has been resolved:
tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
get_burstcount() can return -EBUSY on timeout. When this happens, the function returns directly without releasing the locality that was acquired at the beginning of tpm_tis_i2c_send().
Use goto out_err to ensure proper cleanup when get_burstcount() fails.
{
"affected": [],
"aliases": [
"CVE-2026-45941"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T14:17:10Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure\n\nget_burstcount() can return -EBUSY on timeout. When this happens, the\nfunction returns directly without releasing the locality that was\nacquired at the beginning of tpm_tis_i2c_send().\n\nUse goto out_err to ensure proper cleanup when get_burstcount() fails.",
"id": "GHSA-5p3c-43qg-83mf",
"modified": "2026-06-24T18:32:29Z",
"published": "2026-05-27T15:33:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45941"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1a22048c1117cdfac185ba450aba67ed6b65dc87"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1bb8f8826d0748b4b92a98fb6b6dfe52081739f5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2f7a665e1323359d99c74301d1e180f5e2c40181"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8f124c5582d443ac9fb690db26d08cab5d6ba76e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/948966e546f29af04391d98b8e378e4a7670c1c1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a61b8412e3eb8b71646dba867e8252d8560a1a27"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c24c9c4cab11858f22f309521ba7ea5b1e7385f2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.