CVE-2026-23137: of: unittest: Fix memory leak in unittest_data_add()
In the Linux kernel, the following vulnerability has been resolved:
of: unittest: Fix memory leak in unittestdataadd()
In unittestdataadd(), if ofresolvephandles() fails, the allocated unittestdata is not freed, leading to a memory leak.
Fix this by using scope-based cleanup helper free(kfree) for automatic resource cleanup. This ensures unittestdata is automatically freed when it goes out of scope in error paths.
For the success path, use retainandnullptr() to transfer ownership of the memory to the device tree and prevent double freeing.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23137?
CVE-2026-23137 has a medium severity rating of 5.5 according to the CVSS 3.1 scoring.
How do I fix CVE-2026-23137?
CVE-2026-23137 can be fixed by applying the available patch that addresses the memory leak in unittest_data_add().
What impact does CVE-2026-23137 have on the Linux kernel?
CVE-2026-23137 can lead to a memory leak due to improper cleanup of allocated resources when of_resolve_phandles() fails.
Which software is affected by CVE-2026-23137?
CVE-2026-23137 affects the Linux kernel, specifically the unittest component.
When was CVE-2026-23137 published?
CVE-2026-23137 was published on February 14, 2026.