CVE-2024-26900

md: fix kmemleak of rdev->serial

MEDIUM

5.5

CVSS Score

Published: April 17, 2024 at 10:27 AM UTC

Updated: June 17, 2026 at 07:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev->serial If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be alloc not be freed, and kmemleak occurs. unreferenced object 0xffff88815a350000 (size 49152): comm "mdadm", pid 789, jiffies 4294716910 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc f773277a): [<0000000058b0a453>] kmemleak_alloc+0x61/0xe0 [<00000000366adf14>] __kmalloc_large_node+0x15e/0x270 [<000000002e82961b>] __kmalloc_node.cold+0x11/0x7f [<00000000f206d60a>] kvmalloc_node+0x74/0x150 [<0000000034bf3363>] rdev_init_serial+0x67/0x170 [<0000000010e08fe9>] mddev_create_serial_pool+0x62/0x220 [<00000000c3837bf0>] bind_rdev_to_array+0x2af/0x630 [<0000000073c28560>] md_add_new_disk+0x400/0x9f0 [<00000000770e30ff>] md_ioctl+0x15bf/0x1c10 [<000000006cfab718>] blkdev_ioctl+0x191/0x3f0 [<0000000085086a11>] vfs_ioctl+0x22/0x60 [<0000000018b656fe>] __x64_sys_ioctl+0xba/0xe0 [<00000000e54e675e>] do_syscall_64+0x71/0x150 [<000000008b0ad622>] entry_SYSCALL_64_after_hwframe+0x6c/0x74

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.3 ≤ v < 5.10.2175.3 ≤ v < 5.15.1595.3 ≤ v < 6.1.915.3 ≤ v < 6.6.315.3 ≤ v < 6.7.115.3 ≤ v < 6.8.25.3 ≤ v < 6.96.8 ≤ v < 6.8.25.3963c555e75b033202dd76cf6325a7b7c83d08d5f

Vendor states this is fixed in 4c1021ce46fc2fb6115f7e79d353941e6dcad366 (fixed)

Vendor states this is fixed in 6cf350658736681b9d6b0b6e58c5c76b235bb4c4 (fixed)

Vendor states this is fixed in 6d32c832a88513f65c2c2c9c75954ee8b387adea (fixed)

Vendor states this is fixed in 9fd0198f7ef06ae0d6636fb0578560857dead995 (fixed)

Vendor states this is fixed in beaf11969fd5cbe6f09cefaa34df1ce8578e8dd9 (fixed)

Vendor states this is fixed in f3a1787dc48213f6caea5ba7d47e0222e7fa34a9 (fixed)

Vendor states this is fixed in fb5b347efd1bda989846ffc74679d181222fb123 (fixed)

Vendor states this is fixed in 5.10.217 (unaffected)

Vendor states this is fixed in 5.15.159 (unaffected)

Vendor states this is fixed in 5.3 (unaffected)

Vendor states this is fixed in 6.1.91 (unaffected)

Vendor states this is fixed in 6.6.31 (unaffected)