Medium · published February 14, 2026
In the Linux kernel, the following vulnerability has been resolved:
rocker: fix memory leak in rocker_world_port_post_fini()
In rocker_world_port_pre_init(), rocker_port->wpriv is allocated with
kzalloc(wops->port_priv_size, GFP_KERNEL). However, in
rocker_world_port_post_fini(), the memory is only freed when
wops->port_post_fini callback is set:
if (!wops->port_post_fini)
return;
wops->port_post_fini(rocker_port);
kfree(rocker_port->wpriv);
Since rocker_ofdpa_ops does not implement port_post_fini callback
(it is NULL), the wpriv memory allocated for each port is never freed
when ports are removed. This leads to a memory leak of
sizeof(struct ofdpa_port) bytes per port on every device removal.
Fix this by always calling kfree(rocker_port->wpriv) regardless of
whether the port_post_fini callback exists.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | ≥ 4.6, < 5.10.249 | 5.10.249 |
| linux/linux_kernel | ≥ 5.11, < 5.15.199 | 5.15.199 |
| linux/linux_kernel | ≥ 5.16, < 6.1.162 | 6.1.162 |
| linux/linux_kernel | ≥ 6.2, < 6.6.123 | 6.6.123 |
| linux/linux_kernel | ≥ 6.7, < 6.12.69 | 6.12.69 |
| linux/linux_kernel | ≥ 6.13, < 6.18.9 | 6.18.9 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |