dmaengine: idxd: Fix leaking event log memory (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.12 % · centile 2 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix leaking event log memory During the device remove process, the device is reset, causing the configuration registers to go back to their default state, which is zero. As the driver is checking if the event log support was enabled before deallocating, it will fail if a reset happened before. Do not check if the support was enabled, the check for 'idxd->evl' being valid (only allocated if the HW capability is available) is enough.
Faiblesses (CWE)
- CWE-401 — Mémoire non libérée après sa durée de vie utile
Références
- https://git.kernel.org/stable/c/695b491dc3f20365fd5821f22e25dbe3c1c20cbc
- https://git.kernel.org/stable/c/d94f9b0ba28a205caf95902ee88b42bdb8af83d0
- https://git.kernel.org/stable/c/facd0012708e942fc12890708738aebde497564e
- https://git.kernel.org/stable/c/9dfa00967e6ef43a9dd0887fe5c3a721a39da92e
- https://git.kernel.org/stable/c/ee66bc29578391c9b48523dc9119af67bd5c7c0f
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-24768
- GCVE · GCVE-0-2026-31440
Avis du CERT-FR
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0548 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.4 < 6.12.80cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.21cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.11cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 244da66cda359227d80ccb41dbcb99da40eae186 < 695b491dc3f20365fd5821f22e25dbe3c1c20cbc ; affected 244da66cda359227d80ccb41dbcb99da40eae186 < d94f9b0ba28a205caf95902ee88b42bdb8af83d0 ; affected 244da66cda359227d80ccb41dbcb99da40eae186 < facd0012708e942fc12890708738aebde497564e ; affected 244da66cda359227d80ccb41dbcb99da40eae186 < 9dfa00967e6ef43a9dd0887fe5c3a721a39da92e ; affected 244da66cda359227d80ccb41dbcb99da40eae186 < ee66bc29578391c9b48523dc9119af67bd5c7c0f |
| Linux · Linux | affected 6.4 ; unaffected 0 < 6.4 ; unaffected 6.6.140 ≤ 6.6.* ; unaffected 6.12.80 ≤ 6.12.* ; unaffected 6.18.21 ≤ 6.18.* ; unaffected 6.19.11 ≤ 6.19.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |