Executive brief
A memory leak vulnerability was identified in the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver. This issue occurs during the initialization of certain network-related components, where memory is allocated but not properly released if the setup process fails and retries. Over time, this could lead to excessive memory consumption, potentially impacting system performance or stability.
Technical details
A memory leak exists in the Linux kernel crypto CAAM driver within the dpaa2_caam_probe() function. The vulnerability was introduced when net_device structures were converted to dynamically allocated pointers; while cleanup was added for the standard disable path, it was omitted for error paths in dpaa2_dpseci_free(). When dpaa2_dpseci_dpio_setup() fails (e.g., due to DPIO devices not being ready), the kernel's deferred probe mechanism retries the operation, but previously allocated netdevs are never freed. This results in accumulated kmemleak reports. The fix involves preserving a CPU mask of allocated netdevs to ensure proper deallocation during cleanup. Patches have been merged into stable kernel branches.
Affected products
- Linux Linux Kernel 6.1.x, 6.6.x, 6.12.x, 6.13.x
Timeline
- 2026-01-20: other: Patch authored by Jianpeng Chang
- 2026-01-31: patched: Mainline patch committed by Herbert Xu
- 2026-05-27: advisory: CVE-2026-45900 published by NVD