CVE-2026-43375 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. This driver takes a reference to the USB device during probe but does not to release it on probe failures. Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.
A vulnerability in the Linux kernel's MCTP USB transport driver has been addressed, concerning a memory leak issue. The driver improperly managed references to USB devices, failing to release them during probe failures. This oversight could lead to unnecessary memory consumption and potential leaks. The vulnerability was present in the stable Linux kernel versions 6.1 through 6.15.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. The patched version can be downloaded from the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/224a0d284c3caf1951302d1744a714784febed71 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3224990fb16a831aabc50b67c74f5d0074ce80dd | kernel.org | Patch |
| https://git.kernel.org/stable/c/ec9538f9b5cd1db5e8c612aa636b6119b6355c5d | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.15, < 6.18.19 >= 6.19, < 6.19.9 7.0 rc1 7.0 rc2 7.0 rc3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 15, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | kernel.org |