CVE-2026-23160

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23160
In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Fix memory leak in octep_device_setup() In octep_device_setup(), if octep_ctrl_net_init() fails, the function returns directly without unmapping the mapped resources and freeing the allocated configuration memory. Fix this by jumping to the unsupported_dev label, which performs the necessary cleanup. This aligns with the error handling logic of other paths in this function. Compile tested only. Issue found using a prototype static analysis tool and code review.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/5058d3f8f17202e673f90af1446252322bd0850f Patch
https://git.kernel.org/stable/c/8016dc5ee19a77678c264f8ba368b1e873fa705b Patch
https://git.kernel.org/stable/c/d753f3c3f9d7a6e6dbb4d3a97b73007d71624551 Patch
https://git.kernel.org/stable/c/fdfd28e13c244d7c3345e74f339fd1b67605b694 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
History

18 Mar 2026, 14:12

Type Values Removed Values Added
CWE CWE-401
References () https://git.kernel.org/stable/c/5058d3f8f17202e673f90af1446252322bd0850f - () https://git.kernel.org/stable/c/5058d3f8f17202e673f90af1446252322bd0850f - Patch
References () https://git.kernel.org/stable/c/8016dc5ee19a77678c264f8ba368b1e873fa705b - () https://git.kernel.org/stable/c/8016dc5ee19a77678c264f8ba368b1e873fa705b - Patch
References () https://git.kernel.org/stable/c/d753f3c3f9d7a6e6dbb4d3a97b73007d71624551 - () https://git.kernel.org/stable/c/d753f3c3f9d7a6e6dbb4d3a97b73007d71624551 - Patch
References () https://git.kernel.org/stable/c/fdfd28e13c244d7c3345e74f339fd1b67605b694 - () https://git.kernel.org/stable/c/fdfd28e13c244d7c3345e74f339fd1b67605b694 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
First Time Linux
Linux linux Kernel

18 Feb 2026, 17:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: octeon_ep: Corrección de fuga de memoria en octep_device_setup() En octep_device_setup(), si octep_ctrl_net_init() falla, la función retorna directamente sin desmapear los recursos mapeados y liberar la memoria de configuración asignada. Esto se corrige saltando a la etiqueta unsupported_dev, la cual realiza la limpieza necesaria. Esto se alinea con la lógica de manejo de errores de otras rutas en esta función. Probado únicamente en compilación. Problema encontrado usando una herramienta prototipo de análisis estático y revisión de código.

14 Feb 2026, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-14 16:15

Updated : 2026-03-18 14:12

NVD link : CVE-2026-23160

Mitre link : CVE-2026-23160

CVE.ORG link : CVE-2026-23160

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime