CVE-2026-23028 — Missing Release of Memory after Effective Lifetime in Linux
7 documents6 sources
Severity
5.3MEDIUM
No vectorEPSS
0.0%
top 98.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 31
Description
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()
In kvm_ioctl_create_device(), kvm_device has allocated memory,
kvm_device->destroy() seems to be supposed to free its kvm_device
struct, but kvm_ipi_destroy() is not currently doing this, that
would lead to a memory leak.
So, fix it.
Affected Packages4 packages
▶CVEListV5linux/linuxc532de5a67a70f8533d495f8f2aaa9a0491c3ad0 — 5defcc2f9c22e6e09b5be68234ad10f4ba0292b7+2
🔴Vulnerability Details
3GHSA▶
GHSA-2vjx-859r-qm27: In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()
In kvm_ioctl_create_dev↗2026-01-31
OSV▶
CVE-2026-23028: In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() In kvm_ioctl_create_devic↗2026-01-31