CVE-2026-63839: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmidevevaluateint()
lwmidevevaluateint() leaks output.pointer when retval == NULL (found by sashiko.dev [1]).
Fix it by moving retobj = output.pointer' outside of the if (retval)' block so that it is always freed by the free cleanup callback.
No functional change intended.
Affected Software
Event History
Frequently Asked Questions
Under what condition does the memory leak occur?
The leak occurs in lwmi_dev_evaluate_int() when retval is NULL. In that path, output.pointer was not assigned to ret_obj, preventing the __free cleanup callback from freeing it.
Does the fix change Lenovo WMI helper functionality?
No functional change is intended. The change ensures output.pointer is always assigned for cleanup, including when retval is NULL.
How can I determine whether the fix is present?
Check whether your kernel includes either referenced stable commit: 40a984dd0602e238ad893b167751620e751d1199 or 0c3887a134f191723b53e2a47e501b534c8723ee.