CVE-2026-23464
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, in the soc: microchip: mpfs driver, a memory leak has been detected in the mpfs_sys_controller_probe() function. If of_get_mtd_device_by_node() fails, the function returns without freeing the allocated memory for sys_controller, leading to a memory leak.
Risk Assessment
Memory leak can lead to exhaustion of system resources and potential denial of service (DoS) in systems with Microchip PolarFire SoC.
Recommendation
Update the Linux kernel to a version containing the fix. Also monitor memory usage in systems with this driver.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe() In mpfs_sys_controller_probe(), if of_get_mtd_device_by_node() fails, the function returns immediately without freeing the allocated memory for sys_controller, leading to a memory leak. Fix this by jumping to the out_free label to ensure the memory is properly freed. Also, consolidate the error handling for the mbox_request_channel() failure case to use the same label.