CVE-2024-44971

net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()

State
Published
Severity
Not scored
Published
Sep 4, 2024
Updated
May 11, 2026
Reserved
Aug 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()

bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devices. of_phy_find_device() eventually calls bus_find_device(), which calls get_device() on the returned struct device * to increment the refcount. The current implementation does not decrement the refcount, which causes memory leak.

This commit adds the missing phy_device_free() call to decrement the refcount via put_device() to balance the refcount.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 771089c2a485958e423f305e974303760167b45c to before b7b8d9f5e679af60c94251fd6728dde34be69a71Affected
  • 771089c2a485958e423f305e974303760167b45c to before c05516c072903f6fb9134b8e7e1ad4bffcdc4819Affected
  • 771089c2a485958e423f305e974303760167b45c to before 7feef10768ea71d468d9bbc1e0d14c461876768cAffected
  • 771089c2a485958e423f305e974303760167b45c to before a7d2808d67570e6acae45c2a96e0d59986888e4cAffected
  • 771089c2a485958e423f305e974303760167b45c to before f3d5efe18a11f94150fee8b3fda9d62079af640aAffected
  • 771089c2a485958e423f305e974303760167b45c to before e3862093ee93fcfbdadcb7957f5f8974fffa806aAffected
LinuxLinux
  • 5.10Affected
  • before 5.10Not affected
  • 5.10.224 through 5.10.*Not affected
  • 5.15.165 through 5.15.*Not affected
  • 6.1.105 through 6.1.*Not affected
  • 6.6.46 through 6.6.*Not affected
  • 6.10.5 through 6.10.*Not affected
  • 6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.