CVE-2026-23137
Memory Leak in Linux Kernel unittest_data_add() Function
Publication date: 2026-02-14
Last updated on: 2026-03-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 3.18 (inc) to 6.18.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's unittest component, specifically in the function unittest_data_add(). If the function of_resolve_phandles() fails, the allocated memory for unittest_data is not freed, causing a memory leak.
The issue is fixed by using a scope-based cleanup helper (__free(kfree)) to automatically free the allocated memory when it goes out of scope during error handling. Additionally, for successful operations, retain_and_null_ptr() is used to transfer memory ownership properly and avoid double freeing.
How can this vulnerability impact me? :
This vulnerability can lead to a memory leak in the Linux kernel when unittest_data_add() fails to resolve phandles. Over time, repeated failures could cause increased memory usage, potentially degrading system performance or stability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by updating the Linux kernel to a version where unittest_data_add() properly frees allocated memory on error paths using scope-based cleanup helpers.
Therefore, the immediate step to mitigate this vulnerability is to update your Linux kernel to the patched version that includes this fix.