orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.16 % · percentile 5 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() When insert and remove the orangefs module, there are memory leaked as below: unreferenced object 0xffff88816b0cc000 (size 2048): comm "insmod", pid 783, jiffies 4294813439 (age 65.512s) hex dump (first 32 bytes): 6e 6f 6e 65 0a 00 00 00 00 00 00 00 00 00 00 00 none............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000005b405fee>] orangefs_debugfs_init.cold+0xaf/0x17f [<00000000e5a0085b>] 0xffffffffa02780f9 [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Use the golbal variable as the buffer rather than dynamic allocate to slove the problem.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://git.kernel.org/stable/c/bdc2d33fa2324b1f5ab5b701cda45ee0b2384409
- https://git.kernel.org/stable/c/a076490b0211990ec6764328c22cb744dd782bd9
- https://git.kernel.org/stable/c/c8853267289c55b1acbe4dc3641374887584834d
- https://git.kernel.org/stable/c/786e5296f9e3b045d5ff9098514ce7b8ba1d890d
- https://git.kernel.org/stable/c/0cd303aad220fafa595e0ed593e99aa51b90412b
- https://git.kernel.org/stable/c/31720a2b109b3080eb77e97b8f6f50a27b4ae599
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2025-29989
- GCVE · GCVE-0-2022-50376
CERT-FR advisories
- CERTFR-2025-AVI-0921 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0895 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.6 < 5.4.229cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.163cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.86cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.0.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1 < 6.1.2
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 < bdc2d33fa2324b1f5ab5b701cda45ee0b2384409 ; affected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 < a076490b0211990ec6764328c22cb744dd782bd9 ; affected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 < c8853267289c55b1acbe4dc3641374887584834d ; affected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 < 786e5296f9e3b045d5ff9098514ce7b8ba1d890d ; affected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 < 0cd303aad220fafa595e0ed593e99aa51b90412b ; affected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 < 31720a2b109b3080eb77e97b8f6f50a27b4ae599 |
| Linux · Linux | affected 4.6 ; unaffected 0 < 4.6 ; unaffected 5.4.229 ≤ 5.4.* ; unaffected 5.10.163 ≤ 5.10.* ; unaffected 5.15.86 ≤ 5.15.* ; unaffected 6.0.16 ≤ 6.0.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |