Description
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: fix memory leak in netlbl_cipsov4_add_std
Reported by syzkaller:
BUG: memory leak
unreferenced object 0xffff888105df7000 (size 64):
comm "syz-executor842", pid 360, jiffies 4294824824 (age 22.546s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e67ed558>] kmalloc include/linux/slab.h:590 [inline]
[<00000000e67ed558>] kzalloc include/linux/slab.h:720 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416
[<0000000006040154>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739
[<00000000204d7a1c>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<00000000204d7a1c>] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800
[<00000000c0d6a995>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504
[<00000000d78b9d2c>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
[<000000009733081b>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
[<000000009733081b>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340
[<00000000d5fd43b8>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929
[<000000000a2d1e40>] sock_sendmsg_nosec net/socket.c:654 [inline]
[<000000000a2d1e40>] sock_sendmsg+0x139/0x170 net/socket.c:674
[<00000000321d1969>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350
[<00000000964e16bc>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404
[<000000001615e288>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433
[<000000004ee8b6a5>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47
[<00000000171c7cee>] entry_SYSCALL_64_after_hwframe+0x44/0xae
The memory of doi_def->map.std pointing is allocated in
netlbl_cipsov4_add_std, but no place has freed it. It should be
freed in cipso_v4_doi_free which frees the cipso DOI resource.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 2.6.19 | 4.4.274 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.10.46-1 | — |
| Debian 13 | linux | 5.10.46-1 | — |
| Debian 12 | linux | 5.10.46-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +22 | No fix yet | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-81.91 | — |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1055.58 | — |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1056.58 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1019.22 | — |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1051.55 | — |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1022.23 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1045.47 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1053.57 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1042.46 | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-156.163 | — |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1111.118 | — |
| Ubuntu 18.04 LTS | linux-aws-5.4 | 5.4.0-1055.58~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-azure-4.15 | 4.15.0-1123.136 | — |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1056.58~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp-4.15 | 4.15.0-1108.122 | — |
| Ubuntu 18.04 LTS | linux-gcp-5.4 | 5.4.0-1051.55~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-81.91~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1099.101 | — |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1080.88 | — |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1053.57~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1042.46~18.04.3 | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1069.73+fips2 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1073.76+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1032.37 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1067.71~20.04.1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2053.55 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2035.39 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1069.78 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-gcp-fips | 4.15.0-2018.20 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1111.118~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1123.136~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-gcp | 4.15.0-1108.122~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-156.163~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-oracle | 4.15.0-1080.88~16.04.1 | — |
| Ubuntu Pro 14.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1123.136~14.04.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | kernel-azure +2 | 4.12.14-16.188.1 | SUSE-SU-2024:1979-1 |
| SLES 12 SP5 | kernel-docs +4 | 4.12.14-122.219.1 | SUSE-SU-2024:2184-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | kernel-azure +2 | 4.12.14-16.188.1 | SUSE-SU-2024:1979-1 |
| SLES for SAP 12 SP5 | kernel-syms +2 | 4.12.14-122.219.1 | SUSE-SU-2024:2184-1 |
| SLE Real Time 12 SP5 | kernel-rt +3 | 4.12.14-10.188.1 | SUSE-SU-2024:1983-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.219.1 | SUSE-SU-2024:2184-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_57 | 1-8.3.1 | SUSE-SU-2024:2184-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.238-182.421 | 1.0-0.amzn2 | ALAS2-2021-1685 |
| Amazon Linux 2 | perf +8 | 4.14.238-182.421.amzn2 | ALAS2-2021-1685 |
Advisories 4
- SUSE-SU-2024:1979-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1983-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2184-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2021-1685 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 2, 2025
References
- https://git.kernel.org/stable/c/212166510582631994be4f4b3fe15e10a03c1dd4
- https://git.kernel.org/stable/c/086e92b1d68c6338535f715aad173f8cf4bfbc8c
- https://git.kernel.org/stable/c/6dcea66d3bb519b426282588f38e884e07893c1f
- https://git.kernel.org/stable/c/5340858147e3dc60913fb3dd0cbb758ec4a26e66
- https://git.kernel.org/stable/c/398a24447eb60f060c8994221cb5ae6caf355fa1
- https://git.kernel.org/stable/c/deeeb65c6ee404f2d1fb80b38b2730645c0f4663
- https://git.kernel.org/stable/c/0ffb460be3abac86f884a8c548bb02724ec370f4
- https://git.kernel.org/stable/c/d612c3f3fae221e7ea736d196581c2217304bbbc