Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Linux kernel may leak memory from mismatched free

CVE-2024-38617 · published 2 years ago
Summary

The Linux kernel’s test code sometimes releases memory using the wrong command, which can leave small amounts of memory unreclaimed. While this typically does not cause immediate problems, it can gradually reduce system performance or stability. Apply the latest kernel updates from your distribution to correct the memory handling.

What to do
  • Update debian linux to version 6.8.12-1.
  • Update linux kernel to version 6.9.3.
Affected software
Ecosystem VendorProductAffected versions
Debian:13 debian linux < 6.8.12-1
Fix: upgrade to 6.8.12-1
Debian:14 debian linux < 6.8.12-1
Fix: upgrade to 6.8.12-1
– linux linux_kernel >= 6.2, < 6.6.33
>= 6.7, < 6.8.12
>= 6.9, < 6.9.3
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Linux linux kernel >= 6.9.0, < 6.9.3
Fix: upgrade to 6.9.3
Original advisory text
kunit/fortify: Fix mismatched kvalloc()/vfree() usage
In the Linux kernel, the following vulnerability has been resolved: kunit/fortify: Fix mismatched kvalloc()/vfree() usage The kv*() family of tests were accidentally freeing with vfree() instead of kvfree(). Use kvfree() instead.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-763Release of Invalid Pointer or Reference
Timeline
Published19 Jun 2024
Updated2 Nov 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2024-38617 · OSV
CVE-2024-38617 · NVD
CVE-2024-38617 · OSV
Track software like this
Free during beta