SB2026032093 - Missing release of memory after effective lifetime in Linux kernel base regmap driver

Description

This security bulletin contains information about 1 security vulnerability.

1) Missing release of memory after effective lifetime (CVE-ID: CVE-2026-23260)

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper memory management in the regmap maple tree component when storing a newly allocated block. A local user can trigger a failure in the storage operation to cause memory disclosure.

Memory allocated for a new entry is not freed on failure of mas_store_gfp(), potentially exposing uninitialized memory contents. The issue requires the ability to write to regmap-controlled hardware registers, typically available to privileged users.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/811b45e2d795d955bb7fd9c816b40036f4fde350
• https://git.kernel.org/stable/c/d61171cf097156030142643942c217759a9cc806
• https://git.kernel.org/stable/c/f08f2d2907675926ac5657b25f86d921f269602a
• https://git.kernel.org/stable/c/f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8