CVE-2024-26900

md: fix kmemleak of rdev->serial

State: Published
Severity: Not scored
Published: Apr 17, 2024
Updated: May 11, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

md: fix kmemleak of rdev->serial

If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be alloc not be freed, and kmemleak occurs.

unreferenced object 0xffff88815a350000 (size 49152): comm "mdadm", pid 789, jiffies 4294716910 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc f773277a): [<0000000058b0a453>] kmemleak_alloc+0x61/0xe0 [<00000000366adf14>] __kmalloc_large_node+0x15e/0x270 [<000000002e82961b>] __kmalloc_node.cold+0x11/0x7f [<00000000f206d60a>] kvmalloc_node+0x74/0x150 [<0000000034bf3363>] rdev_init_serial+0x67/0x170 [<0000000010e08fe9>] mddev_create_serial_pool+0x62/0x220 [<00000000c3837bf0>] bind_rdev_to_array+0x2af/0x630 [<0000000073c28560>] md_add_new_disk+0x400/0x9f0 [<00000000770e30ff>] md_ioctl+0x15bf/0x1c10 [<000000006cfab718>] blkdev_ioctl+0x191/0x3f0 [<0000000085086a11>] vfs_ioctl+0x22/0x60 [<0000000018b656fe>] __x64_sys_ioctl+0xba/0xe0 [<00000000e54e675e>] do_syscall_64+0x71/0x150 [<000000008b0ad622>] entry_SYSCALL_64_after_hwframe+0x6c/0x74

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	963c555e75b033202dd76cf6325a7b7c83d08d5f to before fb5b347efd1bda989846ffc74679d181222fb123Affected 963c555e75b033202dd76cf6325a7b7c83d08d5f to before f3a1787dc48213f6caea5ba7d47e0222e7fa34a9Affected 963c555e75b033202dd76cf6325a7b7c83d08d5f to before beaf11969fd5cbe6f09cefaa34df1ce8578e8dd9Affected 963c555e75b033202dd76cf6325a7b7c83d08d5f to before 9fd0198f7ef06ae0d6636fb0578560857dead995Affected 963c555e75b033202dd76cf6325a7b7c83d08d5f to before 6d32c832a88513f65c2c2c9c75954ee8b387adeaAffected 963c555e75b033202dd76cf6325a7b7c83d08d5f to before 4c1021ce46fc2fb6115f7e79d353941e6dcad366Affected 963c555e75b033202dd76cf6325a7b7c83d08d5f to before 6cf350658736681b9d6b0b6e58c5c76b235bb4c4Affected
LinuxLinux	5.3Affected before 5.3Not affected 5.10.217 through 5.10.Not affected 5.15.159 through 5.15.Not affected 6.1.91 through 6.1.Not affected 6.6.31 through 6.6.Not affected 6.7.11 through 6.7.Not affected 6.8.2 through 6.8.Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

963c555e75b033202dd76cf6325a7b7c83d08d5f to before fb5b347efd1bda989846ffc74679d181222fb123Affected
963c555e75b033202dd76cf6325a7b7c83d08d5f to before f3a1787dc48213f6caea5ba7d47e0222e7fa34a9Affected
963c555e75b033202dd76cf6325a7b7c83d08d5f to before beaf11969fd5cbe6f09cefaa34df1ce8578e8dd9Affected
963c555e75b033202dd76cf6325a7b7c83d08d5f to before 9fd0198f7ef06ae0d6636fb0578560857dead995Affected
963c555e75b033202dd76cf6325a7b7c83d08d5f to before 6d32c832a88513f65c2c2c9c75954ee8b387adeaAffected
963c555e75b033202dd76cf6325a7b7c83d08d5f to before 4c1021ce46fc2fb6115f7e79d353941e6dcad366Affected
963c555e75b033202dd76cf6325a7b7c83d08d5f to before 6cf350658736681b9d6b0b6e58c5c76b235bb4c4Affected

LinuxLinux

5.3Affected
before 5.3Not affected
5.10.217 through 5.10.*Not affected
5.15.159 through 5.15.*Not affected
6.1.91 through 6.1.*Not affected
6.6.31 through 6.6.*Not affected
6.7.11 through 6.7.*Not affected
6.8.2 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.