CVE-2026-45922

Analyzed Analyzed - Analysis Complete

Memory Leak in Linux Kernel RDMA/mlx5 Driver

Publication date: 2026-05-27

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler The UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function allocates memory for the device path using kobject_get_path(). If the length of the device path exceeds the output buffer length, the function returns -ENOSPC but does not free the allocated memory, resulting in a memory leak. Add a kfree() call to the error path to ensure the allocated memory is properly freed. Compile tested only. Issue found using a prototype static analysis tool and code review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-24

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45922

EUVD

EUVD-2026-32388

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.14 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.12 (inc) to 6.12.75 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Impact Analysis

This vulnerability can lead to a memory leak in the Linux kernel when handling certain RDMA device paths. Over time, repeated triggering of this issue could consume system memory unnecessarily, potentially degrading system performance or causing instability.

Executive Summary

This vulnerability exists in the Linux kernel's RDMA/mlx5 component, specifically in the GET_DATA_DIRECT_SYSFS_PATH handler function. The function allocates memory for a device path using kobject_get_path(). If the device path length is longer than the output buffer can hold, the function returns an error (-ENOSPC) but fails to free the allocated memory, causing a memory leak.

The issue was fixed by adding a call to kfree() in the error path to ensure that the allocated memory is properly released.

Mitigation Strategies

The vulnerability has been resolved by adding a kfree() call to the error path in the affected function to prevent memory leaks.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-45922. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70