CVE-2026-23164: rocker: fix memory leak in rocker_world_port_post_fini()
In the Linux kernel, the following vulnerability has been resolved:
rocker: fix memory leak in rockerworldportpostfini()
In rockerworldportpreinit(), rockerport->wpriv is allocated with kzalloc(wops->portprivsize, GFPKERNEL). However, in rockerworldportpostfini(), the memory is only freed when wops->portpostfini callback is set:
if (!wops->portpostfini) return; wops->portpostfini(rockerport); kfree(rockerport->wpriv);
Since rockerofdpaops does not implement portpostfini callback (it is NULL), the wpriv memory allocated for each port is never freed when ports are removed. This leads to a memory leak of sizeof(struct ofdpaport) bytes per port on every device removal.
Fix this by always calling kfree(rockerport->wpriv) regardless of whether the portpostfini callback exists.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23164?
CVE-2026-23164 has been classified with a low severity due to the memory leak issue it addresses.
How do I fix CVE-2026-23164?
To fix CVE-2026-23164, users should upgrade to the latest stable version of the Linux kernel that contains the patch.
Which software is affected by CVE-2026-23164?
CVE-2026-23164 affects the Linux kernel specifically in the rocker subsystem.
Is CVE-2026-23164 a remote exploit?
No, CVE-2026-23164 is not a remote exploit as it pertains to a memory leak in kernel space.
What systems are at risk from CVE-2026-23164?
Systems running specific versions of the Linux kernel with the rocker subsystem may be at risk from CVE-2026-23164.