rxrpc: Fix memory leaks in rxkad_verify_response() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.12 % · percentile 2 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix memory leaks in rxkad_verify_response() Fix rxkad_verify_response() to free the ticket and the server key under all circumstances by initialising the ticket pointer to NULL and then making all paths through the function after the first allocation has been done go through a single common epilogue that just releases everything - where all the releases skip on a NULL pointer.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://git.kernel.org/stable/c/c4b8f32e73eafd4a5076be890c7c8506ec04567c
- https://git.kernel.org/stable/c/852b9d64cea421336579b2de3d1338dfa677e2dd
- https://git.kernel.org/stable/c/861b9a0a1823bf064a7b810d29502a9ef043f40f
- https://git.kernel.org/stable/c/c91f33fb8356dedc82bc56ce210f1a5dbee62a52
- https://git.kernel.org/stable/c/34f61a07e0cdefaecd3ec03bb5fb22215643678f
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-32309
- GCVE · GCVE-0-2026-46012
CERT-FR advisories
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0861 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0831 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0731 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 6.6.140cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.86cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.27cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 7.0.4
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected ec832bd06d6fdf08b0455ab7c2a7a9104e029638 < c4b8f32e73eafd4a5076be890c7c8506ec04567c ; affected ec832bd06d6fdf08b0455ab7c2a7a9104e029638 < 852b9d64cea421336579b2de3d1338dfa677e2dd ; affected ec832bd06d6fdf08b0455ab7c2a7a9104e029638 < 861b9a0a1823bf064a7b810d29502a9ef043f40f ; affected ec832bd06d6fdf08b0455ab7c2a7a9104e029638 < c91f33fb8356dedc82bc56ce210f1a5dbee62a52 ; affected ec832bd06d6fdf08b0455ab7c2a7a9104e029638 < 34f61a07e0cdefaecd3ec03bb5fb22215643678f |
| Linux · Linux | affected 5.11 ; unaffected 0 < 5.11 ; unaffected 6.6.140 ≤ 6.6.* ; unaffected 6.12.86 ≤ 6.12.* ; unaffected 6.18.27 ≤ 6.18.* ; unaffected 7.0.4 ≤ 7.0.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |