Executive brief
A memory leak vulnerability was identified in the Linux kernel's support for Microchip PolarFire SoC (MPFS) system controllers. This component manages low-level hardware communications and flash memory access. If exploited, this flaw could allow a local user to exhaust system memory, potentially leading to a system crash or service instability.
Technical details
A memory leak exists in the mpfs_sys_controller_probe() function within drivers/soc/microchip/mpfs-sys-controller.c. The vulnerability occurs when of_get_mtd_device_by_node() or mbox_request_channel() fails; in these error paths, the function previously returned an error code without freeing the memory allocated for the sys_controller structure. A local attacker with sufficient privileges to trigger device probing could repeatedly induce these failures to exhaust kernel memory. The issue has been resolved by consolidating error handling to a label that properly calls kfree() before returning.
Affected products
- Linux Linux Kernel 6.8 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2025-12-28: other: Patch authored
- 2026-04-03: disclosed: CVE published
- 2026-05-20: other: NIST analysis completed