Executive brief
A memory leak was found in the Linux kernel's Intel Thermal Platform Management Interface (TPMI) debugfs memory write handler. When certain error conditions were encountered during debugfs operations, an allocated temporary array was not freed, causing kernel memory to leak. This could be exploited by a local attacker with debugfs access to exhaust kernel memory and degrade system stability.
Technical details
A temporary array allocated by parse_int_array_user() in the mem_write() function of drivers/platform/x86/intel/vsec_tpmi.c was not released on all error exit paths. The function had multiple early return statements for input validation that bypassed the cleanup code. The vulnerability was fixed by converting the array variable to use cleanup.h scope-based cleanup (automatic cleanup on function exit) instead of relying on manual kfree() calls at a centralized exit label. This is a local-only issue requiring debugfs access; no network exposure. A patch is available in upstream Linux kernel and stable branches.
Affected products
- Linux Linux kernel 5.0 and later (before fix applied to stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-06-09: patched: Upstream fix committed; backported to stable branches by 2026-07-24