Riskcovery

CVE-2024-56745

PCI: Fix reset_method_store() memory leak

State
Published
Severity
3.3 Low
Published
Dec 29, 2024
Updated
May 11, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix reset_method_store() memory leak

In reset_method_store(), a string is allocated via kstrndup() and assigned to the local "options". options is then used in with strsep() to find spaces:

while ((name = strsep(&options, " ")) != NULL) {

If there are no remaining spaces, then options is set to NULL by strsep(), so the subsequent kfree(options) doesn't free the memory allocated via kstrndup().

Fix by using a separate tmp_options to iterate with strsep() so options is preserved.

Scores

CVSSScoreVectorSource
3.13.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LCISA-ADP

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
LinuxLinux
  • d88f521da3efd698e36d0d504a2abba6ac4f5ef8 to before 403efb4457c0c8f8f51e904cc57d39193780c6bdAffected
  • d88f521da3efd698e36d0d504a2abba6ac4f5ef8 to before 931d07ccffcc3614f20aaf602b31e89754e21c59Affected
  • d88f521da3efd698e36d0d504a2abba6ac4f5ef8 to before 8e098baf6bc3f3a6aefc383509aba07e202f7ee0Affected
  • d88f521da3efd698e36d0d504a2abba6ac4f5ef8 to before 543d0eb40e45c6a51f1bff02f417b602e54472d5Affected
  • d88f521da3efd698e36d0d504a2abba6ac4f5ef8 to before fe6fae61f3b993160aef5fe2b7141a83872c144fAffected
  • d88f521da3efd698e36d0d504a2abba6ac4f5ef8 to before 2985b1844f3f3447f2d938eff1ef6762592065a5Affected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 5.15.174 through 5.15.*Not affected
  • 6.1.120 through 6.1.*Not affected
  • 6.6.64 through 6.6.*Not affected
  • 6.11.11 through 6.11.*Not affected
  • 6.12.2 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.