Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel flash handling may leak memory, reducing stability
published 5 months ago
Summary
The problem is in the Linux operating system component that reads certain TP‑Link firmware files stored on flash memory devices. If an error happens while processing the file, a small piece of memory is not released, which can gradually lower available memory and cause slower performance or occasional crashes. Install the latest kernel update from your Linux distribution, which includes a fix that correctly frees the memory.
What to do
- Update linux kernel to version 6.19.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Linux | linux | kernel |
>= 6.19.0, < 6.19.4 Fix: upgrade to 6.19.4
|
Original advisory text
mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
In the Linux kernel, the following vulnerability has been resolved:
mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
The function mtd_parser_tplink_safeloader_parse() allocates buf via
mtd_parser_tplink_safeloader_read_table(). If the allocation for
parts[idx].name fails inside the loop, the code jumps to the err_free
label without freeing buf, leading to a memory leak.
Fix this by freeing the temporary buffer buf in the err_free label.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
The function mtd_parser_tplink_safeloader_parse() allocates buf via
mtd_parser_tplink_safeloader_read_table(). If the allocation for
parts[idx].name fails inside the loop, the code jumps to the err_free
label without freeing buf, leading to a memory leak.
Fix this by freeing the temporary buffer buf in the err_free label.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
References
- https://git.kernel.org/stable/c/0f5e62ea5c43146eacdc6861cb1022ffae1b79bc URL
- https://git.kernel.org/stable/c/971e9c53aed82f17a9c6a65daa4e21cc15eba5b1 URL
- https://git.kernel.org/stable/c/980ce2b02dd06a4fdf5fee38b2e14becf9cf7b8b URL
- https://git.kernel.org/stable/c/e97f5fac8ce9a6b9ec724c97d86b0985e915fdca URL
- https://git.kernel.org/stable/c/ec121ad626c319085f6d40a52cd04e99b4554926 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45921... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45921 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Timeline
Published27 May 2026
Updated29 Aug 2026
First seen29 Aug 2026
Track software like this
Free during beta