CVE-2026-23137CWE-401

CVE-2026-23137

Medium · published February 14, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
3.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

of: unittest: Fix memory leak in unittest_data_add()

In unittest_data_add(), if of_resolve_phandles() fails, the allocated

unittest_data is not freed, leading to a memory leak.

Fix this by using scope-based cleanup helper __free(kfree) for automatic

resource cleanup. This ensures unittest_data is automatically freed when

it goes out of scope in error paths.

For the success path, use retain_and_null_ptr() to transfer ownership

of the memory to the device tree and prevent double freeing.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00143 · 3.3th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-02-14T21:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 3.18, < 6.18.66.18.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (4)
EPSS history
Timeline
  • 14 FEB 15:22Z
    of: unittest: Fix memory leak in unittest_data_add()
    cvelistv5