CVE-2026-45921

Analyzed Analyzed - Analysis Complete

Memory Leak in Linux Kernel MTD Parser

Publication date: 2026-05-27

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() The function mtd_parser_tplink_safeloader_parse() allocates buf via mtd_parser_tplink_safeloader_read_table(). If the allocation for parts[idx].name fails inside the loop, the code jumps to the err_free label without freeing buf, leading to a memory leak. Fix this by freeing the temporary buffer buf in the err_free label. Compile tested only. Issue found using a prototype static analysis tool and code review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-24

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45921

EUVD

EUVD-2026-32387

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.14 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.128 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.75 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory leak in the Linux kernel's mtd parser, specifically in the function mtd_parser_tplink_safeloader_parse().

The function allocates a buffer (buf) via mtd_parser_tplink_safeloader_read_table(). If the allocation for parts[idx].name fails inside a loop, the code jumps to an error handling label (err_free) without freeing the previously allocated buffer, causing a memory leak.

The fix involves freeing the temporary buffer buf in the err_free label to prevent the memory leak.

Impact Analysis

A memory leak vulnerability can lead to increased memory usage over time, potentially causing system instability or crashes if the leaked memory accumulates.

In this specific case, the leak occurs in the Linux kernel's mtd parser, which could affect systems using this component, possibly degrading performance or reliability.

Mitigation Strategies

The vulnerability is fixed by updating the Linux kernel to a version where the memory leak in the mtd_parser_tplink_safeloader_parse() function has been resolved.

Specifically, ensure your system is running a kernel version that includes the fix which frees the temporary buffer buf in the err_free label to prevent the memory leak.

Compliance Impact

The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-45921. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70