What’s Vulnerable › Vulnerabilities

CVE-2024-53202: firmware_loader: Fix possible resource leak in fw_log_firmware_info()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-27 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix possible resource leak in fw_log_firmware_info() The alg instance should be released under the exception path, otherwise there may be resource leak here. To mitigate this, free the alg instance with crypto_free_shash when kmalloc fails.

Affected products

• Linux kernel: from 6.4 before 6.6.64; from 6.7 before 6.11.11; from 6.12 before 6.12.2 — fixed in 6.11.11, 6.12.2, 6.6.64

How to fix

Upgrade to a fixed version: Linux kernel 6.11.11, 6.12.2, 6.6.64. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/369a9c046c2fdfe037f05b43b84c386bdbccc103
• https://git.kernel.org/stable/c/789a72498d32f88d24371c10985aceb46397056c
• https://git.kernel.org/stable/c/eb5d67d00ad17a5bd0920f455160dc2ccbd2dc78
• https://git.kernel.org/stable/c/f380f895dbb2a11d62ca6df9e82d995f4bc26b84

Get alerted when CVE-2024-53202 or the next vulnerability affects your stack