CVE-2026-46030: EDAC/versalnet: Fix device_node leak in mc_probe()

Q: What is the severity of CVE-2026-46030?

The severity of CVE-2026-46030 is medium with a CVSS score of 5.5.

Q: What does CVE-2026-46030 exploit?

CVE-2026-46030 exploits a memory leak in the mc_probe() function due to not properly releasing device_node references.

Q: How do I fix CVE-2026-46030?

To fix CVE-2026-46030, ensure that the device_node reference is released properly using of_node_put() in your code.

Q: What type of systems are affected by CVE-2026-46030?

CVE-2026-46030 affects systems running the Linux kernel that utilize EDAC/versalnet.

Q: When was CVE-2026-46030 published?

CVE-2026-46030 was published on May 27, 2026.

Published May 27, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

EDAC/versalnet: Fix devicenode leak in mcprobe()

ofparsephandle() returns a devicenode reference that must be released with ofnodeput(). The original code never freed r5corenode on any exit path, causing a memory leak.

Fix this by using the automatic cleanup attribute free(devicenode) which ensures ofnodeput() is called when the variable goes out of scope.

Affected Software

111 affected componentsFixes available

Linux Linux kernel (EDAC/versalnet)

Linux Linux kernel>=6.18<6.18.27

Linux Linux kernel>=6.19<7.0.4

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14*

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-7.0<7.0.0-28.28~24.04.1

7.0.0-28.28~24.04.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-realtime-6.14*

ubuntu/linux<7.0.0-27.27

7.0.0-27.27

ubuntu/linux-aws<7.0.0-1008.8

7.0.0-1008.8

ubuntu/linux-azure<7.0.0-1010.10

7.0.0-1010.10

ubuntu/linux-azure-fde<7.0.0-1009.9

7.0.0-1009.9

ubuntu/linux-gcp<7.0.0-1007.7

7.0.0-1007.7

ubuntu/linux-ibm<7.0.0-1009.9

7.0.0-1009.9

ubuntu/linux-nvidia<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-oem-7.0<7.0.0-1008.8

7.0.0-1008.8

ubuntu/linux-oracle<7.0.0-1007.7

7.0.0-1007.7

ubuntu/linux-raspi<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-realtime<7.0.0-27.27.1

7.0.0-27.27.1

ubuntu/linux-riscv<7.0.0-27.27.1

7.0.0-27.27.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-28.28~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-27.27
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.8
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1010.10
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1009.9
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1007.7
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1009.9
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.8
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1007.7
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-27.27.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-27.27.1
Compensating control
In EDAC/versalnet mc_probe(), use the automatic cleanup attribute __free(device_node) for r5_core_node so of_node_put() is called when the variable goes out of scope.

Event History

May 27, 2026

CVE Published

via MITRE·12:56 PM

Data Sourced

via MITRE·12:56 PM

Description

Data Sourced

via OSV·02:17 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·02:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-46030?

The severity of CVE-2026-46030 is medium with a CVSS score of 5.5.

What does CVE-2026-46030 exploit?

CVE-2026-46030 exploits a memory leak in the mc_probe() function due to not properly releasing device_node references.

How do I fix CVE-2026-46030?

To fix CVE-2026-46030, ensure that the device_node reference is released properly using of_node_put() in your code.

What type of systems are affected by CVE-2026-46030?

CVE-2026-46030 affects systems running the Linux kernel that utilize EDAC/versalnet.

When was CVE-2026-46030 published?

CVE-2026-46030 was published on May 27, 2026.

CVE-2026-46030: EDAC/versalnet: Fix device_node leak in mc_probe()

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2026-46030?

What does CVE-2026-46030 exploit?

How do I fix CVE-2026-46030?

What type of systems are affected by CVE-2026-46030?

When was CVE-2026-46030 published?

Company

Resources

Contact