CVE-2026-23464
Memory Leak in Linux Kernel Microchip MPFS sys_controller Probe
Publication date: 2026-04-03
Last updated on: 2026-04-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microchip | mpfs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's microchip mpfs driver, specifically in the function mpfs_sys_controller_probe(). When the function of_get_mtd_device_by_node() fails, the code returns immediately without freeing the memory allocated for sys_controller. This causes a memory leak because the allocated memory is not properly released.
The fix involves changing the code to jump to a cleanup label (out_free) to ensure that the allocated memory is freed even if of_get_mtd_device_by_node() fails. Additionally, error handling for another failure case (mbox_request_channel()) was consolidated to use the same cleanup label.
How can this vulnerability impact me? :
This vulnerability can lead to a memory leak in the Linux kernel when the affected function fails to free allocated memory. Over time, this memory leak could cause increased memory usage, potentially leading to degraded system performance or instability, especially on systems running the affected microchip mpfs driver.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the memory leak in mpfs_sys_controller_probe() has been fixed. This fix ensures that allocated memory is properly freed when of_get_mtd_device_by_node() or mbox_request_channel() fails.
If updating is not immediately possible, monitor the system for unusual memory usage patterns related to the microchip mpfs subsystem and consider limiting the use of affected components until a patch is applied.