Linux Kernel CVE-2026-46221

The EDAC (Error Detection and Correction) subsystem in the Linux kernel provides infrastructure for monitoring and reporting hardware memory errors. The versalnet EDAC driver targets AMD/Xilinx Versal SoC platforms. In init_one_mc(), a buffer is allocated via kzalloc() to hold the formatted device name, then assigned to dev->init_name before calling device_register(). A subtle kernel device model behavior is that device_register() internally copies init_name (via kobject_set_name) and subsequently sets dev->init_name to NULL - this is by design to transfer name ownership into the kobject layer. Consequently, the original kzalloc'd pointer is orphaned with no reference remaining in any reachable structure, constituting a classic CWE-401 (Missing Release of Memory after Effective Lifetime) defect. The fix replaces the heap allocation with a stack-local char array, which is automatically reclaimed at function return. CPE data confirms affected products span cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* through the 7.1-rc2 release.