Common Weakness Enumeration

CWE-401

Allowed

Missing Release of Memory after Effective Lifetime

Abstraction: Variant · Status: Draft

API response cwe.mitre.org

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

2002 vulnerabilities reference this CWE, most recent first.

GHSA-4PW5-F49H-H59G

Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-06-24 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens

As prepare can be called mulitple times, this can result in multiple graph opens for playback path.

This will result in a memory leaks, fix this by adding a check before opening.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-46143"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-28T10:16:29Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens\n\nAs prepare can be called mulitple times, this can result in multiple\ngraph opens for playback path.\n\nThis will result in a memory leaks, fix this by adding a check before\nopening.",
  "id": "GHSA-4pw5-f49h-h59g",
  "modified": "2026-06-24T18:32:33Z",
  "published": "2026-05-28T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46143"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3141d8b00cad6d3331953c79060ccc3a0262311b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/69acc488aaf39d0ddf6c3cf0e47c1873d39919a2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7cab9f2ad51c858263da836baebad050a1bc7914"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af9cc7c622e596455c5190e6ef53c5b40ea7a90d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b97493f0f42ab9d882a62466782e1900e481a9d6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c91b7bcc70346d07f57ef03d1b9a338324e213de"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4Q6W-GXHV-H434

Vulnerability from github – Published: 2024-02-28 09:30 – Updated: 2024-12-06 15:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftables: Fix a memleak from userdata error path in new objects

Release object name if userdata allocation fails.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-46996"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-28T09:15:38Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nftables: Fix a memleak from userdata error path in new objects\n\nRelease object name if userdata allocation fails.",
  "id": "GHSA-4q6w-gxhv-h434",
  "modified": "2024-12-06T15:31:19Z",
  "published": "2024-02-28T09:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46996"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2c784a500f5edd337258b0fdb2f31bc9abde1a23"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/59fa98bfa1f4013d658d990cac88c87b46ff410c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/85dfd816fabfc16e71786eda0a33a7046688b5b0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dd3bebf515f336214a91994348a2b86b9a1d3d7f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4Q8Q-65R3-PQP6

Vulnerability from github – Published: 2022-05-24 17:00 – Updated: 2023-02-03 18:30
VLAI
Details

A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering drm_writeback_connector_init() failures, aka CID-a0ecd6fdbf5d.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-18810"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-11-07T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering drm_writeback_connector_init() failures, aka CID-a0ecd6fdbf5d.",
  "id": "GHSA-4q8q-65r3-pqp6",
  "modified": "2023-02-03T18:30:34Z",
  "published": "2022-05-24T17:00:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18810"
    },
    {
      "type": "WEB",
      "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ecd6fdbf5d648123a7315c695fb6850d702835"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20191205-0001"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4208-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4QGQ-37M7-CP67

Vulnerability from github – Published: 2022-02-24 00:00 – Updated: 2022-03-03 00:01
VLAI
Details

IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing a denial of service due to a resource leak. IBM X-Force ID: 219395.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-22336"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-23T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing a denial of service due to a resource leak.  IBM X-Force ID:  219395.",
  "id": "GHSA-4qgq-37m7-cp67",
  "modified": "2022-03-03T00:01:02Z",
  "published": "2022-02-24T00:00:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22336"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/219395"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6558796"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-4QHC-V8R6-8VWM

Vulnerability from github – Published: 2023-11-09 21:30 – Updated: 2023-11-17 22:01
VLAI
Summary
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability
Details

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.14.0"
            },
            {
              "fixed": "1.14.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.0"
            },
            {
              "fixed": "1.15.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-5954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-10T00:43:02Z",
    "nvd_published_at": "2023-11-09T21:15:25Z",
    "severity": "HIGH"
  },
  "details": "HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.",
  "id": "GHSA-4qhc-v8r6-8vwm",
  "modified": "2023-11-17T22:01:34Z",
  "published": "2023-11-09T21:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5954"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hashicorp/vault"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20231227-0001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability"
}

GHSA-4R22-FJ9F-VV8R

Vulnerability from github – Published: 2026-03-25 12:30 – Updated: 2026-06-01 18:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix memory leak in ice_set_ringparam()

In ice_set_ringparam, tx_rings and xdp_rings are allocated before rx_rings. If the allocation of rx_rings fails, the code jumps to the done label leaking both tx_rings and xdp_rings. Furthermore, if the setup of an individual Rx ring fails during the loop, the code jumps to the free_tx label which releases tx_rings but leaks xdp_rings.

Fix this by introducing a free_xdp label and updating the error paths to ensure both xdp_rings and tx_rings are properly freed if rx_rings allocation or setup fails.

Compile tested only. Issue found using a prototype static analysis tool and code review.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-23389"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T11:16:39Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix memory leak in ice_set_ringparam()\n\nIn ice_set_ringparam, tx_rings and xdp_rings are allocated before\nrx_rings. If the allocation of rx_rings fails, the code jumps to\nthe done label leaking both tx_rings and xdp_rings. Furthermore, if\nthe setup of an individual Rx ring fails during the loop, the code jumps\nto the free_tx label which releases tx_rings but leaks xdp_rings.\n\nFix this by introducing a free_xdp label and updating the error paths to\nensure both xdp_rings and tx_rings are properly freed if rx_rings\nallocation or setup fails.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review.",
  "id": "GHSA-4r22-fj9f-vv8r",
  "modified": "2026-06-01T18:31:22Z",
  "published": "2026-03-25T12:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23389"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/44ba32a892b72de3faa04b8cfb1f2f1418fdd580"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/63dc317dfcd3faffd082c2bf3080f9ad070273da"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b23282218eca27b710111460b4964c8a456c6c44"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bddf04e3822e4fa38691433dd0750420d49a0dd6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e0c211a0c26159058303712d6b4fbd1c88835e6d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fe868b499d16f55bbeea89992edb98043c9de416"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4R29-2H26-2X44

Vulnerability from github – Published: 2025-04-14 21:32 – Updated: 2025-04-14 21:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

coresight: syscfg: Fix memleak on registration failure in cscfg_create_device

device_register() calls device_initialize(), according to doc of device_initialize:

Use put_device() to give up your reference instead of freeing
* @dev directly once you have called this function.

To prevent potential memleak, use put_device() for error handling.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-49284"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:05Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: syscfg: Fix memleak on registration failure in cscfg_create_device\n\ndevice_register() calls device_initialize(),\naccording to doc of device_initialize:\n\n    Use put_device() to give up your reference instead of freeing\n    * @dev directly once you have called this function.\n\nTo prevent potential memleak, use put_device() for error handling.",
  "id": "GHSA-4r29-2h26-2x44",
  "modified": "2025-04-14T21:32:20Z",
  "published": "2025-04-14T21:32:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49284"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/412225b32986d5b11c3c1ad9234c50a3f5c52c76"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a529af1f5a5c096f3e18f0d5a32cfcc3d82df1ec"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c61e2fc87f24cae4701f352fe9ecd4c5c143106c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cfa5dbcdd7aece76f3415284569f2f384aff0253"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4V3J-3FR4-CJRJ

Vulnerability from github – Published: 2026-02-04 18:30 – Updated: 2026-03-13 21:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd: Fix memory leak in wbrf_record()

The tmp buffer is allocated using kcalloc() but is not freed if acpi_evaluate_dsm() fails. This causes a memory leak in the error path.

Fix this by explicitly freeing the tmp buffer in the error handling path of acpi_evaluate_dsm().

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-23065"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-04T17:16:17Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd: Fix memory leak in wbrf_record()\n\nThe tmp buffer is allocated using kcalloc() but is not freed if\nacpi_evaluate_dsm() fails. This causes a memory leak in the error path.\n\nFix this by explicitly freeing the tmp buffer in the error handling\npath of acpi_evaluate_dsm().",
  "id": "GHSA-4v3j-3fr4-cjrj",
  "modified": "2026-03-13T21:31:40Z",
  "published": "2026-02-04T18:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23065"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1152dffe01af86e42ce2b208b92ef7f8c275d130"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1a0072bd1f1e559eda3e91a24dbc51c9eb025c54"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2bf1877b7094c684e1d652cac6912cfbc507ad3e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4V57-28QM-CQVR

Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07
VLAI
Details

Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Video Surveillance 7000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a memory leak, which could lead to a denial of service (DoS) condition on an affected device. These vulnerabilities are due to incorrect processing of certain LLDP packets at ingress time. An attacker could exploit these vulnerabilities by sending crafted LLDP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, which could cause the device to crash and reload, resulting in a DoS condition. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-1595"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-08T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Video Surveillance 7000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a memory leak, which could lead to a denial of service (DoS) condition on an affected device. These vulnerabilities are due to incorrect processing of certain LLDP packets at ingress time. An attacker could exploit these vulnerabilities by sending crafted LLDP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, which could cause the device to crash and reload, resulting in a DoS condition. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).",
  "id": "GHSA-4v57-28qm-cqvr",
  "modified": "2022-05-24T19:07:11Z",
  "published": "2022-05-24T19:07:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1595"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipcamera-lldp-mem-wGqundTq"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-4V6X-WQ6P-585M

Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-03 21:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe

Use devm_of_iomap() instead of of_iomap() to automatically handle the unused ioremap region.

If any error occurs, regions allocated by kzalloc() will leak, but using devm_kzalloc() instead will automatically free the memory using devm_kfree().

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-53249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T15:15:52Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe\n\nUse devm_of_iomap() instead of of_iomap() to automatically handle\nthe unused ioremap region.\n\nIf any error occurs, regions allocated by kzalloc() will leak,\nbut using devm_kzalloc() instead will automatically free the memory\nusing devm_kfree().",
  "id": "GHSA-4v6x-wq6p-585m",
  "modified": "2025-12-03T21:31:00Z",
  "published": "2025-09-15T15:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53249"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/188d070de9132667956f5aadd98d2bd87d3eac89"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/294321349bd3b0680847fc2bbe66b9ab3e522fea"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/50b5ddde8fad5f0ffd239029d0956af633a0f9b1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9428cf0fbf4be9a24f3e15a0c166b861b12666af"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9ba3693b0350b154fdd7830559bbc7b04c067096"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d4fa5e47af1e7bb2bbcaac062b14216c00e92148"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-41
Implementation

Strategy: Libraries or Frameworks

  • Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
  • For example, glibc in Linux provides protection against free of invalid pointers.
  • When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
  • To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Architecture and Design

Use an abstraction library to abstract away risky APIs. Not a complete solution.

Mitigation
Architecture and Design Build and Compilation

Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list