SB20261022461 - Memory leak in Linux kernel module

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-98842)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak kernel memory, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to missing release of allocated memory in the Linux kernel module loader when codetag_load_module() fails while loading a livepatch module. A local privileged user can initiate livepatch module loads that encounter this error path to leave the module's mod->klp_info allocation unreleased, potentially exhausting kernel memory if the leak is repeatedly triggered.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/258310d59a82ea4854bfd9138682bbaac1153b19
• https://git.kernel.org/stable/c/bfc721eef5c13704efe6864c7da2ad4b0d75f60a
• https://git.kernel.org/stable/c/c79cf15eb35a4c703bf18f8c33c47e80dd660f8e