Riskcovery

CVE-2026-45950

crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req()

State
Published
Severity
Not scored
Published
May 27, 2026
Updated
May 27, 2026
Reserved
May 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req()

The starfive_aes_aead_do_one_req() function allocates rctx->adata with kzalloc() but fails to free it if sg_copy_to_buffer() or starfive_aes_hw_init() fails, which lead to memory leaks.

Since rctx->adata is unconditionally freed after the write_adata operations, ensure consistent cleanup by freeing the allocation in these earlier error paths as well.

Compile tested only. Issue found using a prototype static analysis tool and code review.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7467147ef9bf42d1ea5b3314c7a05cd542b3518e to before 38d80307decc1132626a30e2a62af734630ecca5Affected
  • 7467147ef9bf42d1ea5b3314c7a05cd542b3518e to before 4869d0e4e48a5301b267d359b2561c4080791a55Affected
  • 7467147ef9bf42d1ea5b3314c7a05cd542b3518e to before 5f2c964a058581e1557c32d5de651c67a80438a7Affected
  • 7467147ef9bf42d1ea5b3314c7a05cd542b3518e to before ccb679fdae2e62ed92fd9acb25ed809c0226fcc6Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.75 through 6.12.*Not affected
  • 6.18.14 through 6.18.*Not affected
  • 6.19.4 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.