Executive brief
The Linux kernel's RISC-V cache information initialization code has a memory reference leak in the populate_cache_leaves function. When the function processes cache hierarchy data, it fails to properly release memory references under normal completion, allowing memory to accumulate over time. While not exploitable for immediate code execution, repeated triggering could degrade system performance and potentially be leveraged as part of a denial-of-service attack.
Technical details
This is a reference-counting leak in kernel device-tree (of_node) handling within arch/riscv/kernel/cacheinfo.c. The vulnerable code iterates through device-tree nodes representing CPU cache levels, dropping a reference to the previous node in each loop iteration. However, when the loop terminates naturally (np == NULL), the code incorrectly calls of_node_put(np) instead of of_node_put(prev), which is a no-op on a NULL pointer. This leaves the final valid node reference undropped. The fix changes the cleanup call from of_node_put(np) to of_node_put(prev). No authentication or user interaction is required—the leak occurs during normal kernel boot and cache enumeration. The vulnerability affects RISC-V systems and a patch is available in the Linux stable kernel tree.
Affected products
- Linux Linux kernel Multiple RISC-V supported versions (see stable tree branches)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Fix committed upstream and backported to stable branches