Skip to main content

Linux Kernel CVE-2026-45888

| EUVDEUVD-2026-32354 MEDIUM
Memory Leak (CWE-401)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-9686-wrhg-jjg6
Linux Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
1.9 LOW

RAID1 assembly requires CAP_SYS_ADMIN (PR:H); triggering the specific failure path is non-trivial (AC:H); single-instance leak is minor (A:L), not immediate crash.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 25, 2026 - 21:31 vuln.today
CVSS changed
Jun 25, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: fix memory leak in raid1_run()

raid1_run() calls setup_conf() which registers a thread via md_register_thread(). If raid1_set_limits() fails, the previously registered thread is not unregistered, resulting in a memory leak of the md_thread structure and the thread resource itself.

Add md_unregister_thread() to the error path to properly cleanup the thread, which aligns with the error handling logic of other paths in this function.

Compile tested only. Issue found using a prototype static analysis tool and code review.

AnalysisAI

Memory leak in the Linux kernel's md/raid1 subsystem allows a local attacker with access to RAID configuration interfaces to gradually exhaust kernel memory by repeatedly triggering the faulty error path in raid1_run(). Affected kernel versions span multiple stable branches prior to 6.12.75, 6.18.14, 6.19.4, and 7.0. No public exploit identified at time of analysis; EPSS at 0.02% (5th percentile) and confirmed discovery via static analysis rather than active exploitation signals minimal real-world risk. Vendor-released patches are available across all affected stable branches.

Technical ContextAI

The vulnerability resides in the Linux kernel's Multiple Devices (md) subsystem, specifically the RAID1 (disk mirroring) driver at drivers/md/raid1.c. CPE data confirms the affected product is cpe:2.3:o:linux:linux_kernel across multiple kernel versions. The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): within raid1_run(), the function setup_conf() registers a kernel thread via md_register_thread(), allocating an md_thread structure. If the subsequent call to raid1_set_limits() fails, the error path exits without invoking md_unregister_thread(), leaving the thread handle and its associated kernel memory allocated but unreachable by the caller. The fix adds md_unregister_thread() to the error path, consistent with how other error paths in the same function handle cleanup. The issue was identified through static analysis tooling and manual code review, not runtime testing or active exploitation.

RemediationAI

Vendor-released patches are available. Upgrade to Linux kernel 6.12.75, 6.18.14, 6.19.4, or 7.0 depending on the stable branch in use. Upstream fix commits can be applied directly for out-of-tree builds: https://git.kernel.org/stable/c/6abc7d5dcf0ee0f85e16e41c87fbd06231f28753, https://git.kernel.org/stable/c/b37588b0282a2b3cdda9db1d53712745ce66dea0, https://git.kernel.org/stable/c/c94fd6e8a71efd047ff36930e840f3c25679e136, and https://git.kernel.org/stable/c/ec10e3dc93994b87adf7c759a4639fe34013989a. For systems that cannot be immediately patched, restrict access to md device management interfaces - specifically, limit which accounts can invoke mdadm or write to /dev/md* and /sys/block/md* paths - to reduce the set of principals who can trigger RAID1 assembly operations. This compensating control narrows exposure but does not eliminate the underlying defect. Kernel live-patching solutions (kpatch, livepatch) may be applicable on distributions that support them, avoiding a full reboot.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-45888 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy