CVE-2026-46030: EDAC/versalnet: Fix device_node leak in mc_probe()
In the Linux kernel, the following vulnerability has been resolved:
EDAC/versalnet: Fix devicenode leak in mcprobe()
ofparsephandle() returns a devicenode reference that must be released with ofnodeput(). The original code never freed r5corenode on any exit path, causing a memory leak.
Fix this by using the automatic cleanup attribute free(devicenode) which ensures ofnodeput() is called when the variable goes out of scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the mc_probe() implementation to declare the device_node reference (r5_core_node) with the __free(device_node) automatic cleanup attribute so that of_node_put() is invoked when the variable goes out of scope. Rebuild and deploy the updated kernel containing this change.
Linux kernel (EDAC/versalnet mc_probe) use __free(device_node) automatic cleanup attribute for device_node refs = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46030?
The severity of CVE-2026-46030 is medium with a CVSS score of 5.5.
What does CVE-2026-46030 exploit?
CVE-2026-46030 exploits a memory leak in the mc_probe() function due to not properly releasing device_node references.
How do I fix CVE-2026-46030?
To fix CVE-2026-46030, ensure that the device_node reference is released properly using of_node_put() in your code.
What type of systems are affected by CVE-2026-46030?
CVE-2026-46030 affects systems running the Linux kernel that utilize EDAC/versalnet.
When was CVE-2026-46030 published?
CVE-2026-46030 was published on May 27, 2026.