CVE-2026-23137
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
14/02/2026
Last modified:
17/03/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
of: unittest: Fix memory leak in unittest_data_add()<br />
<br />
In unittest_data_add(), if of_resolve_phandles() fails, the allocated<br />
unittest_data is not freed, leading to a memory leak.<br />
<br />
Fix this by using scope-based cleanup helper __free(kfree) for automatic<br />
resource cleanup. This ensures unittest_data is automatically freed when<br />
it goes out of scope in error paths.<br />
<br />
For the success path, use retain_and_null_ptr() to transfer ownership<br />
of the memory to the device tree and prevent double freeing.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 3.18 (including) | 6.18.6 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page