scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 10 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced object 0xffff88810b2c6980 (size 32): comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [<0000000098f3a26d>] alua_activate+0xb0/0x320 [<000000003b529641>] scsi_dh_activate+0xb2/0x140 [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] [<000000007adc9ace>] process_one_work+0x3c5/0x730 [<00000000c457a985>] worker_thread+0x93/0x650 [<00000000cb80e628>] kthread+0x1ba/0x210 [<00000000a1e61077>] ret_from_fork+0x22/0x30 Fix the problem by freeing 'qdata' in error path.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://git.kernel.org/stable/c/123483df146492ca22b503ae6dacc2ce7c3a3974
- https://git.kernel.org/stable/c/c110051d335ef7f62ad33474b0c23997fee5bfb5
- https://git.kernel.org/stable/c/5c4d71424df34fc23dc5336d09394ce68c849542
- https://git.kernel.org/stable/c/c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8
- https://git.kernel.org/stable/c/9311e7a554dffd3823499e309a8b86a5cd1540e5
- https://git.kernel.org/stable/c/1c55982beb80c7d3c30278fc6cfda8496a31dbe6
- https://git.kernel.org/stable/c/0d89254a4320eb7de0970c478172f764125c6355
- https://git.kernel.org/stable/c/a13faca032acbf2699293587085293bdfaafc8ae
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-13171
- GCVE · GCVE-0-2023-53078
CERT-FR advisories
- CERTFR-2026-AVI-0081 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1009 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0587 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0560 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0529 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0509 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.9.21 < 4.10cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.10.9 < 4.11cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.11.1 < 4.14.312cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 4.19.280cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.240cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.177cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.105cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.22cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.2.9cpe:2.3:o:linux:linux_kernel:4.11:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:4.11:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:4.11:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:4.11:rc7:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:4.11:rc8:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 123483df146492ca22b503ae6dacc2ce7c3a3974 ; affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < c110051d335ef7f62ad33474b0c23997fee5bfb5 ; affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 5c4d71424df34fc23dc5336d09394ce68c849542 ; affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < c09cdf6eb815ee35e55d6c50ac7f63db58bd20b8 ; affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 9311e7a554dffd3823499e309a8b86a5cd1540e5 ; affected 625fe857e4fac6518716f3c0ff5e5deb8ec6d238 < 1c55982beb80c7d3c30278fc6cfda8496a31dbe6 |
| Linux · Linux | affected 4.11 ; unaffected 0 < 4.11 ; unaffected 4.14.312 ≤ 4.14.* ; unaffected 4.19.280 ≤ 4.19.* ; unaffected 5.4.240 ≤ 5.4.* ; unaffected 5.10.177 ≤ 5.10.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |