What’s Vulnerable › Vulnerabilities

CVE-2026-23137: of: unittest: Fix memory leak in unittest_data_add()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-14 · updated 2026-10-30
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: of: unittest: Fix memory leak in unittest_data_add() In unittest_data_add(), if of_resolve_phandles() fails, the allocated unittest_data is not freed, leading to a memory leak. Fix this by using scope-based cleanup helper __free(kfree) for automatic resource cleanup. This ensures unittest_data is automatically freed when it goes out of scope in error paths. For the success path, use retain_and_null_ptr() to transfer ownership of the memory to the device tree and prevent double freeing.

Affected products

• Linux kernel: from 3.18 before 6.18.6; 6.19-rc1, 6.19-rc2, 6.19-rc3, 6.19-rc4 — fixed in 6.18.6
• Linux: 3.18 — fixed in 6.19

How to fix

Upgrade to a fixed version: Linux kernel 6.18.6; Linux 6.19. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b
• https://git.kernel.org/stable/c/4bafaec9e3a784d103ab9da11095708fcca70e76
• https://git.kernel.org/stable/c/4c7ad40c285ab85e3614433e063f14aac2e2fe17
• https://git.kernel.org/stable/c/58baf98d1bdab897fd796f39a16061bade229d71
• https://git.kernel.org/stable/c/f09b0f705bd7197863b90256ef533a6414d1db2c

Get alerted when CVE-2026-23137 or the next vulnerability affects your stack