SB20260528154 - Memory leak in Linux kernel mtd parsers driver
Published: May 28, 2026
Security Bulletin ID
SB20260528154
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Memory leak (CVE-ID: CVE-2026-45921)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a memory leak in mtd_parser_tplink_safeloader_parse() when parsing TP-Link safeloader partition tables. A local user can trigger an allocation failure for parts[idx].name to cause a denial of service.
The issue was identified through static analysis and code review.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0f5e62ea5c43146eacdc6861cb1022ffae1b79bc
- https://git.kernel.org/stable/c/971e9c53aed82f17a9c6a65daa4e21cc15eba5b1
- https://git.kernel.org/stable/c/980ce2b02dd06a4fdf5fee38b2e14becf9cf7b8b
- https://git.kernel.org/stable/c/e97f5fac8ce9a6b9ec724c97d86b0985e915fdca
- https://git.kernel.org/stable/c/ec121ad626c319085f6d40a52cd04e99b4554926