CVE-2022-26878 — Missing Release of Memory after Effective Lifetime in Kernel

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-772 — Missing Release of Resource after Effective Lifetime8 documents7 sources
Severity
5.5MEDIUMNVD
OSV4.6
EPSS
0.1%
top 71.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Linux KernelDebian LinuxMsrc Cbl2 Kernel 5.15.32.1-2 ON CBL Mariner 2.0+1 more
Timeline
PublishedMar 11
Latest updateApr 20

Description

drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶NVDlinux/linux_kernel5.13 — 5.15.17+1
▶Debianlinux/linux_kernel< 5.16.7-1+2
▶debiandebian/linux< linux 5.16.7-1 (bookworm)

Patches

Patch: www.openwall.com ↗Patch: git.kernel.org ↗Patch: lore.kernel.org ↗

🔴Vulnerability Details

3
OSV
linux, linux-aws, linux-aws-5.13, linux-azure, linux-azure-5.13, linux-gcp, linux-gcp-5.13, linux-hwe-5.13, linux-kvm, linux-oracle, linux-oracle-5.13, linux-raspi vulnerabilities↗2022-04-20
▶
GHSA
GHSA-7rp6-p829-5x6w: drivers/bluetooth/virtio_bt↗2022-03-12
▶
OSV
CVE-2022-26878: drivers/bluetooth/virtio_bt↗2022-03-11
▶

📋Vendor Advisories

4
Ubuntu
Linux kernel vulnerabilities↗2022-04-20
▶
Red Hat
kernel: Memory leak in Linux VirtIO Bluetooth driver↗2022-03-11
▶
Microsoft
drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).↗2022-03-08
▶
Debian
CVE-2022-26878: linux - drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory lea...↗2022
▶