CVE-2024-26894: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
In the Linux kernel, the following vulnerability has been resolved:
ACPI: processoridle: Fix memory leak in acpiprocessorpowerexit()
After unregistering the CPU idle device, the memory associated with it is not freed, leading to a memory leak:
unreferenced object 0xffff896282f6c000 (size 1024): comm "swapper/0", pid 1, jiffies 4294893170 hex dump (first 32 bytes): 00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 8836a742): [<ffffffff993495ed>] kmalloctrace+0x29d/0x340 [<ffffffff9972f3b3>] acpiprocessorpowerinit+0xf3/0x1c0 [<ffffffff9972d263>] acpiprocessorstart+0xd3/0xf0 [<ffffffff9972d2bc>] acpiprocessorstart+0x2c/0x50 [<ffffffff99805872>] reallyprobe+0xe2/0x480 [<ffffffff99805c98>] driverprobedevice+0x78/0x160 [<ffffffff99805daf>] driverprobedevice+0x1f/0x90 [<ffffffff9980601e>] driverattach+0xce/0x1c0 [<ffffffff99803170>] busforeachdev+0x70/0xc0 [<ffffffff99804822>] busadddriver+0x112/0x210 [<ffffffff99807245>] driverregister+0x55/0x100 [<ffffffff9aee4acb>] acpiprocessordriverinit+0x3b/0xc0 [<ffffffff990012d1>] dooneinitcall+0x41/0x300 [<ffffffff9ae7c4b0>] kernelinitfreeable+0x320/0x470 [<ffffffff99b231f6>] kernelinit+0x16/0x1b0 [<ffffffff99042e6d>] retfromfork+0x2d/0x50
Fix this by freeing the CPU idle device after unregistering it.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ACPI: processoridle: Fix memory leak in acpiprocessorpowerexit()
The Linux kernel CVE team has assigned CVE-2024-26894 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041743-CVE-2024-26894-53ad@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26894?
CVE-2024-26894 has been classified as a medium severity vulnerability due to the potential for memory leaks in the Linux kernel.
How do I fix CVE-2024-26894?
To fix CVE-2024-26894, update your kernel to one of the patched versions listed, such as 5.10.223-1 or 6.1.123-1.
What systems are affected by CVE-2024-26894?
CVE-2024-26894 affects specific versions of the Linux kernel across various distributions, including Debian and Red Hat.
What are the symptoms of CVE-2024-26894?
The primary symptom of CVE-2024-26894 is a gradual increase in memory usage due to memory leaks during CPU idle states.
Is CVE-2024-26894 considered a critical vulnerability?
CVE-2024-26894 is not considered critical, but it should still be addressed to prevent excessive memory consumption.