In the Linux kernel, the following vulnerability has been resolved:
dma-buf/dma-resv: Stop leaking on krealloc() failure
Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fails.
Free the old array by hand, and make sure we still clear the returned *fences so the caller won't end up accessing freed memory. Some (but not all) of the callers of dma_resv_get_fences() seem to still trawl through the array even when dma_resv_get_fences() failed. And let's zero out *num_fences as well for good measure.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade perf-debuginfoUpgrade kernel-libbpf-develUpgrade bpftool-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-livepatch-6.1.49-69.116Upgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade bpftoolUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-libbpfUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo | Sep 30, 2025 | Sep 15, 2025 |
| Debian | — | Upgrade linux | Sep 17, 2025 | Sep 17, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub