CVE-2024-27388

SUNRPC: fix some memleaks in gssx_dec_option_array

State: Published
Severity: 9.8 Critical
Published: May 1, 2024
Updated: Aug 5, 2026
Reserved: Feb 25, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: fix some memleaks in gssx_dec_option_array

The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the corresponding paths.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1d658336b05f8697d6445834f8867f8ad5e4f735 to before b97c37978ca825557d331c9012e0c1ddc0e42364Affected 1d658336b05f8697d6445834f8867f8ad5e4f735 to before bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8Affected 1d658336b05f8697d6445834f8867f8ad5e4f735 to before bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8Affected 1d658336b05f8697d6445834f8867f8ad5e4f735 to before dd292e884c649f9b1c18af0ec75ca90b390cd044Affected 1d658336b05f8697d6445834f8867f8ad5e4f735 to before 934212a623cbab851848b6de377eb476718c3e4cAffected 1d658336b05f8697d6445834f8867f8ad5e4f735 to before 5e6013ae2c8d420faea553d363935f65badd32c3Affected 1d658336b05f8697d6445834f8867f8ad5e4f735 to before 9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4Affected 1d658336b05f8697d6445834f8867f8ad5e4f735 to before 996997d1fb2126feda550d6adcedcbd94911fc69Affected 1d658336b05f8697d6445834f8867f8ad5e4f735 to before 3cfcfc102a5e57b021b786a755a38935e357797dAffected
LinuxLinux	3.10Affected before 3.10Not affected 4.19.311 through 4.19.Not affected 5.4.273 through 5.4.Not affected 5.10.214 through 5.10.Not affected 5.15.153 through 5.15.Not affected 6.1.83 through 6.1.Not affected 6.6.23 through 6.6.Not affected 6.7.11 through 6.7.Not affected 6.8.2 through 6.8.Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

1d658336b05f8697d6445834f8867f8ad5e4f735 to before b97c37978ca825557d331c9012e0c1ddc0e42364Affected
1d658336b05f8697d6445834f8867f8ad5e4f735 to before bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8Affected
1d658336b05f8697d6445834f8867f8ad5e4f735 to before bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8Affected
1d658336b05f8697d6445834f8867f8ad5e4f735 to before dd292e884c649f9b1c18af0ec75ca90b390cd044Affected
1d658336b05f8697d6445834f8867f8ad5e4f735 to before 934212a623cbab851848b6de377eb476718c3e4cAffected
1d658336b05f8697d6445834f8867f8ad5e4f735 to before 5e6013ae2c8d420faea553d363935f65badd32c3Affected
1d658336b05f8697d6445834f8867f8ad5e4f735 to before 9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4Affected
1d658336b05f8697d6445834f8867f8ad5e4f735 to before 996997d1fb2126feda550d6adcedcbd94911fc69Affected
1d658336b05f8697d6445834f8867f8ad5e4f735 to before 3cfcfc102a5e57b021b786a755a38935e357797dAffected

LinuxLinux

3.10Affected
before 3.10Not affected
4.19.311 through 4.19.*Not affected
5.4.273 through 5.4.*Not affected
5.10.214 through 5.10.*Not affected
5.15.153 through 5.15.*Not affected
6.1.83 through 6.1.*Not affected
6.6.23 through 6.6.*Not affected
6.7.11 through 6.7.*Not affected
6.8.2 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.