Executive brief
A vulnerability in the Linux kernel's memory management system could lead to a resource leak when hardware memory is removed from a running system. This issue affects the 'hotplug' feature, which allows for adding or removing system memory without a reboot. While primarily a technical stability issue, such leaks can eventually lead to system instability or resource exhaustion over long periods of operation.
Technical details
A reference leak exists in the mm/memory_hotplug.c component of the Linux kernel. The function remove_memory_blocks_and_altmaps() calls find_memory_block(), which increments the reference count of the memory block device. However, the code failed to call put_device() to decrement this reference count before completing the removal process. This results in a leaked device reference, preventing proper cleanup of memory block structures. The issue was introduced in version 6.8 and has been patched in various stable branches including 6.12.92, 6.18.34, 7.0.11, and 7.1.
Affected products
- Linux Linux 6.8 to 7.1
Timeline
- 2026-07-19: advisory: NVD publication date
- 2026-06-01: patched: Fix committed to stable branches by Greg Kroah-Hartman