CVE-2026-97473: powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()
In the Linux kernel, the following vulnerability has been resolved:
powercap: intelrapl: Fix memory leak in rapladdpackagecpuslocked()
When topologyphysicalpackageid()/topologylogicaldieid() returns a negative value, rapladdpackagecpuslocked() returns ERRPTR(-EINVAL) directly without freeing the raplpackage structure that was just allocated by kzallocobj(), leaking memory on every failed package addition.
Use the existing errfreepackage label so that the allocation is released on the error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What condition triggers the memory leak?
The leak occurs when rapl_add_package_cpuslocked() attempts to add a package and topology_physical_package_id() or topology_logical_die_id() returns a negative value. In that error path, the newly allocated rapl_package structure was not freed.
What is the practical impact of repeated failures?
Each failed package addition under the affected topology error condition leaks one rapl_package allocation. Repeated failures can therefore consume kernel memory over time.
How is the issue fixed?
The fix routes the negative topology-ID error path through the existing err_free_package label, which releases the rapl_package allocation before returning -EINVAL.