CVE-2026-46221: EDAC/versalnet: Fix device name memory leak
In the Linux kernel, the following vulnerability has been resolved:
EDAC/versalnet: Fix device name memory leak
The device name allocated via kzalloc() in initonemc() is assigned to dev->initname but never freed on the normal removal path. deviceregister() copies initname and then sets dev->initname to NULL, so the name pointer becomes unreachable from the device. Thus leaking memory.
Use a stack-local char array instead of using kzalloc() for name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify init_one_mc() to use a stack-local char array for the device name rather than allocating it with kzalloc(), so dev->init_name is not leaked (device_register() copies init_name and sets dev->init_name to NULL).
EDAC/versalnet (Linux kernel) device name allocation = stack-local char array instead of kzalloc()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46221?
CVE-2026-46221 has a risk rating of 4, indicating a moderate severity level.
What is the primary issue addressed by CVE-2026-46221?
CVE-2026-46221 addresses a memory leak caused by the device name not being freed during the normal removal path in the Linux kernel.
How do I fix CVE-2026-46221?
To fix CVE-2026-46221, update your Linux kernel to the version that includes the patch for the device name memory leak.
Which software is affected by CVE-2026-46221?
CVE-2026-46221 affects the Linux kernel, specifically in the EDAC/versalnet module.
When was CVE-2026-46221 published?
CVE-2026-46221 was published on May 28, 2026.