CVE-2026-45922
Awaiting Analysis Awaiting Analysis - Queue
Memory Leak in Linux Kernel RDMA/mlx5 Driver

Publication date: 2026-05-27

Last updated on: 2026-05-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler The UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function allocates memory for the device path using kobject_get_path(). If the length of the device path exceeds the output buffer length, the function returns -ENOSPC but does not free the allocated memory, resulting in a memory leak. Add a kfree() call to the error path to ensure the allocated memory is properly freed. Compile tested only. Issue found using a prototype static analysis tool and code review.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-05-27
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-45922
EUVD
EUVD-2026-32388
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's RDMA/mlx5 component, specifically in the GET_DATA_DIRECT_SYSFS_PATH handler function. The function allocates memory for a device path using kobject_get_path(). If the device path length is longer than the output buffer can hold, the function returns an error (-ENOSPC) but fails to free the allocated memory, causing a memory leak.

The issue was fixed by adding a call to kfree() in the error path to ensure that the allocated memory is properly released.

Impact Analysis

This vulnerability can lead to a memory leak in the Linux kernel when handling certain RDMA device paths. Over time, repeated triggering of this issue could consume system memory unnecessarily, potentially degrading system performance or causing instability.

Mitigation Strategies

The vulnerability has been resolved by adding a kfree() call to the error path in the affected function to prevent memory leaks.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45922. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart