CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2187 vulnerabilities reference this CWE, most recent first.
GHSA-5WP9-X843-XMXF
Vulnerability from github – Published: 2026-06-25 09:31 – Updated: 2026-09-08 09:35In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_fib: fix stale stack leak via the OIFNAME register
For NFT_FIB_RESULT_OIFNAME the destination register is declared with len = IFNAMSIZ (four 32-bit registers), but on the lookup-fail, RTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one register via "*dest = 0". The remaining three registers are left as whatever was on the stack in nft_do_chain()'s struct nft_regs, and a downstream expression that loads the register span can leak that uninitialised kernel stack to userspace.
The NFTA_FIB_F_PRESENT existence check has the same shape: it is only meaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type while the eval stores a single byte via nft_reg_store8(), leaving the rest of the declared span stale.
Fix both:
-
replace the bare "*dest = 0" in the eval with nft_fib_store_result(), which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already used on the other early-return path), and
-
restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its destination as a single u8, so the marked span matches the one byte the eval writes.
{
"affected": [],
"aliases": [
"CVE-2026-53134"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T09:16:30Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_fib: fix stale stack leak via the OIFNAME register\n\nFor NFT_FIB_RESULT_OIFNAME the destination register is declared with\nlen = IFNAMSIZ (four 32-bit registers), but on the lookup-fail,\nRTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one\nregister via \"*dest = 0\". The remaining three registers are left as\nwhatever was on the stack in nft_do_chain()\u0027s struct nft_regs, and a\ndownstream expression that loads the register span can leak that\nuninitialised kernel stack to userspace.\n\nThe NFTA_FIB_F_PRESENT existence check has the same shape: it is only\nmeaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type\nwhile the eval stores a single byte via nft_reg_store8(), leaving the rest\nof the declared span stale.\n\nFix both:\n\n - replace the bare \"*dest = 0\" in the eval with nft_fib_store_result(),\n which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already\n used on the other early-return path), and\n\n - restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its\n destination as a single u8, so the marked span matches the one byte\n the eval writes.",
"id": "GHSA-5wp9-x843-xmxf",
"modified": "2026-09-08T09:35:33Z",
"published": "2026-06-25T09:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53134"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3544210609f6d1db282bbdeca639104ef624c393"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6744e49fe51bfba26522acc2d0e9703cb41d8e50"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/84d8f58cf28a0415413f43ba7148f7bacd4c1b6e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8c84885e9790823828bb8084736ea15769b1ac16"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ab185e0c4fb82dfba6fb86f8271e06f931d9c64c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d19ddef8c327a4773ff81f8e51027d1e0b4cf069"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eb8a8124484dbc3c2b543e207da39bbccb703d31"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eca18feed38b3377a2ec5d1f22af1170c55d0171"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5WX2-VV79-WFG8
Vulnerability from github – Published: 2025-09-17 15:30 – Updated: 2025-12-11 18:30In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix memory leak when build ntlmssp negotiate blob failed
There is a memory leak when mount cifs: unreferenced object 0xffff888166059600 (size 448): comm "mount.cifs", pid 51391, jiffies 4295596373 (age 330.596s) hex dump (first 32 bytes): fe 53 4d 42 40 00 00 00 00 00 00 00 01 00 82 00 .SMB@........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000060609a61>] mempool_alloc+0xe1/0x260 [<00000000adfa6c63>] cifs_small_buf_get+0x24/0x60 [<00000000ebb404c7>] __smb2_plain_req_init+0x32/0x460 [<00000000bcf875b4>] SMB2_sess_alloc_buffer+0xa4/0x3f0 [<00000000753a2987>] SMB2_sess_auth_rawntlmssp_negotiate+0xf5/0x480 [<00000000f0c1f4f9>] SMB2_sess_setup+0x253/0x410 [<00000000a8b83303>] cifs_setup_session+0x18f/0x4c0 [<00000000854bd16d>] cifs_get_smb_ses+0xae7/0x13c0 [<000000006cbc43d9>] mount_get_conns+0x7a/0x730 [<000000005922d816>] cifs_mount+0x103/0xd10 [<00000000e33def3b>] cifs_smb3_do_mount+0x1dd/0xc90 [<0000000078034979>] smb3_get_tree+0x1d5/0x300 [<000000004371f980>] vfs_get_tree+0x41/0xf0 [<00000000b670d8a7>] path_mount+0x9b3/0xdd0 [<000000005e839a7d>] __x64_sys_mount+0x190/0x1d0 [<000000009404c3b9>] do_syscall_64+0x35/0x80
When build ntlmssp negotiate blob failed, the session setup request should be freed.
{
"affected": [],
"aliases": [
"CVE-2022-50372"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-17T15:15:36Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix memory leak when build ntlmssp negotiate blob failed\n\nThere is a memory leak when mount cifs:\n unreferenced object 0xffff888166059600 (size 448):\n comm \"mount.cifs\", pid 51391, jiffies 4295596373 (age 330.596s)\n hex dump (first 32 bytes):\n fe 53 4d 42 40 00 00 00 00 00 00 00 01 00 82 00 .SMB@...........\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [\u003c0000000060609a61\u003e] mempool_alloc+0xe1/0x260\n [\u003c00000000adfa6c63\u003e] cifs_small_buf_get+0x24/0x60\n [\u003c00000000ebb404c7\u003e] __smb2_plain_req_init+0x32/0x460\n [\u003c00000000bcf875b4\u003e] SMB2_sess_alloc_buffer+0xa4/0x3f0\n [\u003c00000000753a2987\u003e] SMB2_sess_auth_rawntlmssp_negotiate+0xf5/0x480\n [\u003c00000000f0c1f4f9\u003e] SMB2_sess_setup+0x253/0x410\n [\u003c00000000a8b83303\u003e] cifs_setup_session+0x18f/0x4c0\n [\u003c00000000854bd16d\u003e] cifs_get_smb_ses+0xae7/0x13c0\n [\u003c000000006cbc43d9\u003e] mount_get_conns+0x7a/0x730\n [\u003c000000005922d816\u003e] cifs_mount+0x103/0xd10\n [\u003c00000000e33def3b\u003e] cifs_smb3_do_mount+0x1dd/0xc90\n [\u003c0000000078034979\u003e] smb3_get_tree+0x1d5/0x300\n [\u003c000000004371f980\u003e] vfs_get_tree+0x41/0xf0\n [\u003c00000000b670d8a7\u003e] path_mount+0x9b3/0xdd0\n [\u003c000000005e839a7d\u003e] __x64_sys_mount+0x190/0x1d0\n [\u003c000000009404c3b9\u003e] do_syscall_64+0x35/0x80\n\nWhen build ntlmssp negotiate blob failed, the session setup request\nshould be freed.",
"id": "GHSA-5wx2-vv79-wfg8",
"modified": "2025-12-11T18:30:31Z",
"published": "2025-09-17T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50372"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/30b2d7f8f13664655480d6af45f60270b3eb6736"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fa5a70bdd5e565c8696fb04dfe18a4e8aff4695d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5X4F-4RC3-FXCX
Vulnerability from github – Published: 2026-02-02 18:31 – Updated: 2026-02-02 18:31Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.
{
"affected": [],
"aliases": [
"CVE-2025-47397"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-02T16:16:19Z",
"severity": "HIGH"
},
"details": "Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.",
"id": "GHSA-5x4f-4rc3-fxcx",
"modified": "2026-02-02T18:31:32Z",
"published": "2026-02-02T18:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47397"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2026-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5X7Q-6F7M-FC5C
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-05-24 17:36An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking information is freed. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Only systems using the Ocaml Xenstored implementation are vulnerable. Systems using the C Xenstored implementation are not vulnerable.
{
"affected": [],
"aliases": [
"CVE-2020-29485"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-15T18:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking information is freed. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Only systems using the Ocaml Xenstored implementation are vulnerable. Systems using the C Xenstored implementation are not vulnerable.",
"id": "GHSA-5x7q-6f7m-fc5c",
"modified": "2022-05-24T17:36:33Z",
"published": "2022-05-24T17:36:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29485"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2C6M6S3CIMEBACH6O7V4H2VDANMO6TVA"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBLV6L6Q24PPQ2CRFXDX4Q76KU776GKI"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4812"
},
{
"type": "WEB",
"url": "https://xenbits.xenproject.org/xsa/advisory-330.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5XGR-QHGC-XHWH
Vulnerability from github – Published: 2022-05-13 01:13 – Updated: 2025-04-20 03:39Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.
{
"affected": [],
"aliases": [
"CVE-2017-9374"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-16T22:29:00Z",
"severity": "MODERATE"
},
"details": "Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.",
"id": "GHSA-5xgr-qhgc-xhwh",
"modified": "2025-04-20T03:39:19Z",
"published": "2022-05-13T01:13:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9374"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2392"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2408"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1459132"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"type": "WEB",
"url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d710e1e7bd3d5bfc26b631f02ae87901ebe646b0"
},
{
"type": "WEB",
"url": "http://git.qemu.org/?p=qemu.git;a=commit;h=d710e1e7bd3d5bfc26b631f02ae87901ebe646b0"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3920"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/06/06/3"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98905"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6264-3HHV-77HG
Vulnerability from github – Published: 2024-05-17 15:31 – Updated: 2026-05-12 12:31In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().
{
"affected": [],
"aliases": [
"CVE-2024-35828"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T14:15:18Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()\n\nIn the for statement of lbs_allocate_cmd_buffer(), if the allocation of\ncmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to\nbe freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().",
"id": "GHSA-6264-3hhv-77hg",
"modified": "2026-05-12T12:31:47Z",
"published": "2024-05-17T15:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35828"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4d99d267da3415db2124029cb5a6d2d955ca43f9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5f0e4aede01cb01fa633171f0533affd25328c3a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8e243ac649c10922a6b4855170eaefe4c5b3faab"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/96481624fb5a6319079fb5059e46dbce43a90186"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bea9573c795acec5614d4ac2dcc7b3b684cea5bf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d219724d4b0ddb8ec7dfeaed5989f23edabaf591"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da10f6b7918abd5b4bc5c9cb66f0fc6763ac48f3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e888c4461e109f7b93c3522afcbbaa5a8fdf29d2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f0dd27314c7afe34794c2aa19dd6f2d30eb23bc7"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-62G2-5R5G-GCXP
Vulnerability from github – Published: 2022-05-24 22:00 – Updated: 2022-05-24 22:00ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.
{
"affected": [],
"aliases": [
"CVE-2019-16710"
],
"database_specific": {
"cwe_ids": [
"CWE-401",
"CWE-772"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-23T12:15:00Z",
"severity": "MODERATE"
},
"details": "ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.",
"id": "GHSA-62g2-5r5g-gcxp",
"modified": "2022-05-24T22:00:41Z",
"published": "2022-05-24T22:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16710"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/issues/1528"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4192-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4712"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-62G2-8MJ9-VF3F
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-13 21:31In the Linux kernel, the following vulnerability has been resolved:
memory: mtk-smi: fix device leak on larb probe
Make sure to drop the reference taken when looking up the SMI device during larb probe on late probe failure (e.g. probe deferral) and on driver unbind.
{
"affected": [],
"aliases": [
"CVE-2025-71287"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:27Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: mtk-smi: fix device leak on larb probe\n\nMake sure to drop the reference taken when looking up the SMI device\nduring larb probe on late probe failure (e.g. probe deferral) and on\ndriver unbind.",
"id": "GHSA-62g2-8mj9-vf3f",
"modified": "2026-05-13T21:31:56Z",
"published": "2026-05-06T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71287"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/04057b86fdac3d4847913a97dc6552c0bff9b85e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1288bb394d464975cea18f69940f206e235e0fe7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1f23a48ff2b8ab47e514f7c84a4b1dbf9b848168"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/357e16a7fc9c1fef2ea37dce9bb6b9bcb1d1687d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9dae65913b32d05dbc8ff4b8a6bf04a0e49a8eb6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b9eccd59697f7e1cb9a714501d9af826e7f7e073"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f69535b77fa0518ad39870c00dd2995439ed5c34"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-62G8-53XP-7372
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-02 03:31In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix memory leaks in error path
The memory allocated by vxlan_vnigroup_init() is not freed in the error path, leading to memory leaks [1]. Fix by calling vxlan_vnigroup_uninit() in the error path.
The leaks can be reproduced by annotating gro_cells_init() with ALLOW_ERROR_INJECTION() and then running:
# echo "100" > /sys/kernel/debug/fail_function/probability # echo "1" > /sys/kernel/debug/fail_function/times # echo "gro_cells_init" > /sys/kernel/debug/fail_function/inject # printf %#x -12 > /sys/kernel/debug/fail_function/gro_cells_init/retval # ip link add name vxlan0 type vxlan dstport 4789 external vnifilter RTNETLINK answers: Cannot allocate memory
[1] unreferenced object 0xffff88810db84a00 (size 512): comm "ip", pid 330, jiffies 4295010045 (age 66.016s) hex dump (first 32 bytes): f8 d5 76 0e 81 88 ff ff 01 00 00 00 00 00 00 02 ..v............. 03 00 04 00 48 00 00 00 00 00 00 01 04 00 01 00 ....H........... backtrace: [] kmalloc_trace+0x2a/0x60 [] vxlan_vnigroup_init+0x4c/0x160 [] vxlan_init+0x1ae/0x280 [] register_netdevice+0x57a/0x16d0 [] __vxlan_dev_create+0x7c7/0xa50 [] vxlan_newlink+0xd6/0x130 [] __rtnl_newlink+0x112b/0x18a0 [] rtnl_newlink+0x6c/0xa0 [] rtnetlink_rcv_msg+0x43f/0xd40 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x53f/0x810 [] netlink_sendmsg+0x958/0xe70 [] _syssendmsg+0x78f/0xa90 [] _sys_sendmsg+0x13a/0x1e0 [] __sys_sendmsg+0x11c/0x1f0 [] do_syscall_64+0x38/0x80 unreferenced object 0xffff88810e76d5f8 (size 192): comm "ip", pid 330, jiffies 4295010045 (age 66.016s) hex dump (first 32 bytes): 04 00 00 00 00 00 00 00 db e1 4f e7 00 00 00 00 ..........O..... 08 d6 76 0e 81 88 ff ff 08 d6 76 0e 81 88 ff ff ..v.......v..... backtrace: [] __kmalloc_node+0x4e/0x90 [] kvmalloc_node+0xa6/0x1f0 [] bucket_table_alloc.isra.0+0x83/0x460 [] rhashtable_init+0x43b/0x7c0 [] vxlan_vnigroup_init+0x6c/0x160 [] vxlan_init+0x1ae/0x280 [] register_netdevice+0x57a/0x16d0 [] __vxlan_dev_create+0x7c7/0xa50 [] vxlan_newlink+0xd6/0x130 [] __rtnl_newlink+0x112b/0x18a0 [] rtnl_newlink+0x6c/0xa0 [] rtnetlink_rcv_msg+0x43f/0xd40 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x53f/0x810 [] netlink_sendmsg+0x958/0xe70 [] ____sys_sendmsg+0x78f/0xa90
{
"affected": [],
"aliases": [
"CVE-2023-53190"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T14:15:41Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix memory leaks in error path\n\nThe memory allocated by vxlan_vnigroup_init() is not freed in the error\npath, leading to memory leaks [1]. Fix by calling\nvxlan_vnigroup_uninit() in the error path.\n\nThe leaks can be reproduced by annotating gro_cells_init() with\nALLOW_ERROR_INJECTION() and then running:\n\n # echo \"100\" \u003e /sys/kernel/debug/fail_function/probability\n # echo \"1\" \u003e /sys/kernel/debug/fail_function/times\n # echo \"gro_cells_init\" \u003e /sys/kernel/debug/fail_function/inject\n # printf %#x -12 \u003e /sys/kernel/debug/fail_function/gro_cells_init/retval\n # ip link add name vxlan0 type vxlan dstport 4789 external vnifilter\n RTNETLINK answers: Cannot allocate memory\n\n[1]\nunreferenced object 0xffff88810db84a00 (size 512):\n comm \"ip\", pid 330, jiffies 4295010045 (age 66.016s)\n hex dump (first 32 bytes):\n f8 d5 76 0e 81 88 ff ff 01 00 00 00 00 00 00 02 ..v.............\n 03 00 04 00 48 00 00 00 00 00 00 01 04 00 01 00 ....H...........\n backtrace:\n [\u003cffffffff81a3097a\u003e] kmalloc_trace+0x2a/0x60\n [\u003cffffffff82f049fc\u003e] vxlan_vnigroup_init+0x4c/0x160\n [\u003cffffffff82ecd69e\u003e] vxlan_init+0x1ae/0x280\n [\u003cffffffff836858ca\u003e] register_netdevice+0x57a/0x16d0\n [\u003cffffffff82ef67b7\u003e] __vxlan_dev_create+0x7c7/0xa50\n [\u003cffffffff82ef6ce6\u003e] vxlan_newlink+0xd6/0x130\n [\u003cffffffff836d02ab\u003e] __rtnl_newlink+0x112b/0x18a0\n [\u003cffffffff836d0a8c\u003e] rtnl_newlink+0x6c/0xa0\n [\u003cffffffff836c0ddf\u003e] rtnetlink_rcv_msg+0x43f/0xd40\n [\u003cffffffff83908ce0\u003e] netlink_rcv_skb+0x170/0x440\n [\u003cffffffff839066af\u003e] netlink_unicast+0x53f/0x810\n [\u003cffffffff839072d8\u003e] netlink_sendmsg+0x958/0xe70\n [\u003cffffffff835c319f\u003e] ____sys_sendmsg+0x78f/0xa90\n [\u003cffffffff835cd6da\u003e] ___sys_sendmsg+0x13a/0x1e0\n [\u003cffffffff835cd94c\u003e] __sys_sendmsg+0x11c/0x1f0\n [\u003cffffffff8424da78\u003e] do_syscall_64+0x38/0x80\nunreferenced object 0xffff88810e76d5f8 (size 192):\n comm \"ip\", pid 330, jiffies 4295010045 (age 66.016s)\n hex dump (first 32 bytes):\n 04 00 00 00 00 00 00 00 db e1 4f e7 00 00 00 00 ..........O.....\n 08 d6 76 0e 81 88 ff ff 08 d6 76 0e 81 88 ff ff ..v.......v.....\n backtrace:\n [\u003cffffffff81a3162e\u003e] __kmalloc_node+0x4e/0x90\n [\u003cffffffff81a0e166\u003e] kvmalloc_node+0xa6/0x1f0\n [\u003cffffffff8276e1a3\u003e] bucket_table_alloc.isra.0+0x83/0x460\n [\u003cffffffff8276f18b\u003e] rhashtable_init+0x43b/0x7c0\n [\u003cffffffff82f04a1c\u003e] vxlan_vnigroup_init+0x6c/0x160\n [\u003cffffffff82ecd69e\u003e] vxlan_init+0x1ae/0x280\n [\u003cffffffff836858ca\u003e] register_netdevice+0x57a/0x16d0\n [\u003cffffffff82ef67b7\u003e] __vxlan_dev_create+0x7c7/0xa50\n [\u003cffffffff82ef6ce6\u003e] vxlan_newlink+0xd6/0x130\n [\u003cffffffff836d02ab\u003e] __rtnl_newlink+0x112b/0x18a0\n [\u003cffffffff836d0a8c\u003e] rtnl_newlink+0x6c/0xa0\n [\u003cffffffff836c0ddf\u003e] rtnetlink_rcv_msg+0x43f/0xd40\n [\u003cffffffff83908ce0\u003e] netlink_rcv_skb+0x170/0x440\n [\u003cffffffff839066af\u003e] netlink_unicast+0x53f/0x810\n [\u003cffffffff839072d8\u003e] netlink_sendmsg+0x958/0xe70\n [\u003cffffffff835c319f\u003e] ____sys_sendmsg+0x78f/0xa90",
"id": "GHSA-62g8-53xp-7372",
"modified": "2025-12-02T03:31:35Z",
"published": "2025-09-15T15:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53190"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/06bf62944144a92d83dd14fd1378d2a288259561"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5896f55810680391a32652ca2b91245a05c11e22"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/75c1ab900f7cf0485f0be1607c79c55f51faaa90"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-62M8-JJ4J-QM8P
Vulnerability from github – Published: 2026-03-18 18:31 – Updated: 2026-05-21 21:30In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix reservation leak in some error paths when inserting inline extent
If we fail to allocate a path or join a transaction, we return from __cow_file_range_inline() without freeing the reserved qgroup data, resulting in a leak. Fix this by ensuring we call btrfs_qgroup_free_data() in such cases.
{
"affected": [],
"aliases": [
"CVE-2025-71268"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-18T18:16:21Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reservation leak in some error paths when inserting inline extent\n\nIf we fail to allocate a path or join a transaction, we return from\n__cow_file_range_inline() without freeing the reserved qgroup data,\nresulting in a leak. Fix this by ensuring we call btrfs_qgroup_free_data()\nin such cases.",
"id": "GHSA-62m8-jj4j-qm8p",
"modified": "2026-05-21T21:30:28Z",
"published": "2026-03-18T18:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71268"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/28768bd3abf9995a93f6e01bfce01c60622964dd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/28b97fcbbf523779688e8de5fe55bf2dae3859f6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c1c050f92d8f6aac4e17f7f2230160794fceef0c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f7156512c8166d385f574b9ec030479aa7b1e8c9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.