CVE-2025-71147 — Missing Release of Memory after Effective Lifetime in Linux

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-772 — Missing Release of Resource after Effective Lifetime29 documents7 sources
Severity
5.5MEDIUMNVD
OSV7.8
EPSS
0.0%
top 95.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
LinuxLinux KernelDebian Linux+11 more
Timeline
PublishedJan 23
Latest updateApr 17

Description

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2_load_cmd 'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode' but it is not freed in the failure paths. Address this by wrapping the blob into with a cleanup helper.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages16 packages

▶NVDlinux/linux_kernel5.13 — 5.15.198+4
▶Debianlinux/linux_kernel< 6.1.162-1+2
▶Ubuntulinux/linux_kernel< 5.15.0-173.183
▶CVEListV5linux/linuxf2219745250f388edacabe6cca73654131c67d0a — 3fd7df4636d8fd5e3592371967a5941204368936+6
▶debiandebian/linux< linux 6.1.162-1 (bookworm)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

9
OSV
linux-raspi vulnerabilities↗2026-04-01
▶
OSV
linux-intel-iot-realtime vulnerabilities↗2026-03-23
▶
OSV
linux-nvidia-tegra-igx vulnerabilities↗2026-03-23
▶
OSV
linux-realtime vulnerabilities↗2026-03-17
▶
OSV
linux-aws-5.15, linux-gcp-5.15, linux-gke, linux-hwe-5.15, linux-intel-iotg-5.15, linux-lowlatency-hwe-5.15, linux-oracle-5.15 vulnerabilities↗2026-03-17
▶

📋Vendor Advisories

18
Ubuntu
Linux kernel (GCP) vulnerabilities↗2026-04-17
▶
Ubuntu
Linux kernel (FIPS) vulnerabilities↗2026-04-17
▶
Ubuntu
Linux kernel (Real-time) vulnerabilities↗2026-04-17
▶
Ubuntu
Linux kernel (Real-time) vulnerabilities↗2026-04-17
▶
Ubuntu
Linux kernel (NVIDIA) vulnerabilities↗2026-04-17
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-71147 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶