Common Weakness Enumeration
CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2031 vulnerabilities reference this CWE, most recent first.
GHSA-FG9P-Q72C-PR97
Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-07-04 12:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
iio: light: bh1780: fix PM runtime leak on error path
Move pm_runtime_put_autosuspend() before the error check to ensure the PM runtime reference count is always decremented after pm_runtime_get_sync(), regardless of whether the read operation succeeds or fails.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-43355"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-08T15:16:46Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: bh1780: fix PM runtime leak on error path\n\nMove pm_runtime_put_autosuspend() before the error check to ensure\nthe PM runtime reference count is always decremented after\npm_runtime_get_sync(), regardless of whether the read operation\nsucceeds or fails.",
"id": "GHSA-fg9p-q72c-pr97",
"modified": "2026-07-04T12:30:27Z",
"published": "2026-05-08T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43355"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1eb3af4f59e09323788860a9155e9766b12891e5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/33661bfc85c14836bfef4425a74b0ca2df4bb5ad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4228f7f053b452be625919ccbb605912bae0dc98"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/424bf90e87134effe4bd932608a15286493b11ab"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aae572ddc28578af476cce7da3faec0395ef0bf0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ad58fa1cb11e4ceb702786a494352c7ff2eca1ed"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dd72e6c3cdea05cad24e99710939086f7a113fb5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc77e0a5600e620a2ae51ec78933162fb217b20b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FGR8-GCXJ-6PQ5
Vulnerability from github – Published: 2025-04-17 18:31 – Updated: 2025-04-17 21:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path
In es58x_rx_err_msg(), if can->do_set_mode() fails, the function directly returns without calling netif_rx(skb). This means that the skb previously allocated by alloc_can_err_skb() is not freed. In other terms, this is a memory leak.
This patch simply removes the return statement in the error branch and let the function continue.
Issue was found with GCC -fanalyzer, please follow the link below for details.
Severity
{
"affected": [],
"aliases": [
"CVE-2021-47671"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T18:15:43Z",
"severity": "LOW"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path\n\nIn es58x_rx_err_msg(), if can-\u003edo_set_mode() fails, the function\ndirectly returns without calling netif_rx(skb). This means that the\nskb previously allocated by alloc_can_err_skb() is not freed. In other\nterms, this is a memory leak.\n\nThis patch simply removes the return statement in the error branch and\nlet the function continue.\n\nIssue was found with GCC -fanalyzer, please follow the link below for\ndetails.",
"id": "GHSA-fgr8-gcxj-6pq5",
"modified": "2025-04-17T21:31:04Z",
"published": "2025-04-17T18:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47671"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f389e1276a5389c92cef860c9fde8e1c802a871"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7eb0881aec26099089f12ae850aebd93190b1dfe"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d9447f768bc8c60623e4bb3ce65b8f4654d33a50"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FGXF-M96P-5M7Q
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14
VLAI
Details
Memory leak in the infe_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-33363"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-13T20:15:00Z",
"severity": "MODERATE"
},
"details": "Memory leak in the infe_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.",
"id": "GHSA-fgxf-m96p-5m7q",
"modified": "2022-05-24T19:14:15Z",
"published": "2022-05-24T19:14:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33363"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/issues/1786"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/commit/ec64c7b8966d7e4642d12debb888be5acf18efb9"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5411"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FH33-V9VQ-826F
Vulnerability from github – Published: 2024-05-22 09:31 – Updated: 2025-01-07 21:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
'skb' is allocated in digital_in_send_sdd_req(), but not free when digital_in_send_cmd() failed, which will cause memory leak. Fix it by freeing 'skb' if digital_in_send_cmd() return failed.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-47442"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T07:15:09Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: digital: fix possible memory leak in digital_in_send_sdd_req()\n\n\u0027skb\u0027 is allocated in digital_in_send_sdd_req(), but not free when\ndigital_in_send_cmd() failed, which will cause memory leak. Fix it\nby freeing \u0027skb\u0027 if digital_in_send_cmd() return failed.",
"id": "GHSA-fh33-v9vq-826f",
"modified": "2025-01-07T21:30:54Z",
"published": "2024-05-22T09:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47442"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/071bdef36391958c89af5fa2172f691b31baa212"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/291c932fc3692e4d211a445ba8aa35663831bac7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2bde4aca56db9fe25405d39ddb062531493a65db"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/50cb95487c265187289810addec5093d4fed8329"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6432d7f1d1c3aa74cfe8f5e3afdf81b786c32e86"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/74569c78aa84f8c958f1334b465bc530906ec99a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88c890b0b9a1fb9fcd01c61ada515e8b636c34f9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fcce6e5255474ca33c27dda0cdf9bf5087278873"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FH4Q-XRMP-HV9J
Vulnerability from github – Published: 2025-10-22 18:30 – Updated: 2025-10-22 18:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix anon_dev leak in create_subvol()
When btrfs_qgroup_inherit(), btrfs_alloc_tree_block, or btrfs_insert_root() fail in create_subvol(), we return without freeing anon_dev. Reorganize the error handling in create_subvol() to fix this.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-49469"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:01:23Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix anon_dev leak in create_subvol()\n\nWhen btrfs_qgroup_inherit(), btrfs_alloc_tree_block, or\nbtrfs_insert_root() fail in create_subvol(), we return without freeing\nanon_dev. Reorganize the error handling in create_subvol() to fix this.",
"id": "GHSA-fh4q-xrmp-hv9j",
"modified": "2025-10-22T18:30:31Z",
"published": "2025-10-22T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49469"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2256e901f5bddc56e24089c96f27b77da932dfcc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7a875ad8706f0903a0e812e0dd701956ee9826ff"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d887b3de318834f9aa637ecf79c6bc66cba7c69a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FH6C-P6Q9-8M5F
Vulnerability from github – Published: 2025-01-10 21:31 – Updated: 2025-01-14 15:30
VLAI
Details
On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being terminated (causing SNMP requests to time out until snmpd is restarted) and memory pressure for other processes on the switch. Increased memory pressure can cause processes other than snmpd to be at risk for unexpected termination as well.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-7095"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-10T21:15:13Z",
"severity": "MODERATE"
},
"details": "On affected platforms running Arista EOS with SNMP configured, if \u201csnmp-server transmit max-size\u201d is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being terminated (causing SNMP requests to time out until snmpd is restarted) and memory pressure for other processes on the switch. Increased memory pressure can cause processes other than snmpd to be at risk for unexpected termination as well.",
"id": "GHSA-fh6c-p6q9-8m5f",
"modified": "2025-01-14T15:30:51Z",
"published": "2025-01-10T21:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7095"
},
{
"type": "WEB",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/20650-security-advisory-0107"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FHRJ-R6WW-VQ67
Vulnerability from github – Published: 2026-07-11 15:30 – Updated: 2026-07-11 15:30
VLAI
Details
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-61870"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-11T14:16:24Z",
"severity": "LOW"
},
"details": "ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.",
"id": "GHSA-fhrj-r6ww-vq67",
"modified": "2026-07-11T15:30:24Z",
"published": "2026-07-11T15:30:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m596-67p7-69wh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61870"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/imagemagick-before-26-memory-leak-via-viff-encoder"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FJ56-2H43-2HCW
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-03 21:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
PNP: fix name memory leak in pnp_alloc_dev()
After commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically, move dev_set_name() after pnp_add_id() to avoid memory leak.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-50278"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T15:15:38Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nPNP: fix name memory leak in pnp_alloc_dev()\n\nAfter commit 1fa5ae857bb1 (\"driver core: get rid of struct device\u0027s\nbus_id string array\"), the name of device is allocated dynamically,\nmove dev_set_name() after pnp_add_id() to avoid memory leak.",
"id": "GHSA-fj56-2h43-2hcw",
"modified": "2025-12-03T21:30:59Z",
"published": "2025-09-15T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50278"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/110d7b0325c55ff3620073ba4201845f59e22ebf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1f50c7497a5f89de0c31f2edf086af41ff834320"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/290dd73b943c95c006df973257076ff163adf4d0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/693a0c13c1f0c0fcaa1e38cb806cc0789bd415aa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/81b024df4755e6bb6993b786584eca6eabbb9791"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bbcf772216aa237036cc3ae3158288d0a95aaf4d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c12b314bb23dc0c83e03402cc84574700947e3b2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dac87e295cddc8ab316cff14ab2071b5221d84fa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ea77b4b761cd75e5456f677311babfa0418f289a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FJ7C-VG2V-CCRM
Vulnerability from github – Published: 2022-07-15 21:07 – Updated: 2022-09-08 14:21
VLAI
Summary
Undertow vulnerable to memory exhaustion due to buffer leak
Details
Buffer leak on incoming WebSocket PONG message(s) in Undertow before 2.0.40 and 2.2.10 can lead to memory exhaustion and allow a denial of service.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.40"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3690"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-401"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-15T21:07:20Z",
"nvd_published_at": "2022-08-23T16:15:00Z",
"severity": "HIGH"
},
"details": "Buffer leak on incoming WebSocket PONG message(s) in Undertow before 2.0.40 and 2.2.10 can lead to memory exhaustion and allow a denial of service.",
"id": "GHSA-fj7c-vg2v-ccrm",
"modified": "2022-09-08T14:21:49Z",
"published": "2022-07-15T21:07:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3690"
},
{
"type": "WEB",
"url": "https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2021-3690"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2021-3690#cve-cvss-v3"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1991299"
},
{
"type": "PACKAGE",
"url": "https://github.com/undertow-io/undertow"
},
{
"type": "WEB",
"url": "https://issues.redhat.com/browse/UNDERTOW-1935"
},
{
"type": "WEB",
"url": "https://www.mend.io/vulnerability-database/CVE-2021-3690"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Undertow vulnerable to memory exhaustion due to buffer leak"
}
GHSA-FJFJ-R96F-8HQW
Vulnerability from github – Published: 2025-01-31 12:33 – Updated: 2026-05-12 15:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix bpf_sk_select_reuseport() memory leak
As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_EBPF set before it was ESTABLISHED. In other words, a non-NULL sk_reuseport_cb does not imply a non-refcounted socket.
Drop sk's reference in both error paths.
unreferenced object 0xffff888101911800 (size 2048): comm "test_progs", pid 44109, jiffies 4297131437 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 80 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 9336483b): __kmalloc_noprof+0x3bf/0x560 __reuseport_alloc+0x1d/0x40 reuseport_alloc+0xca/0x150 reuseport_attach_prog+0x87/0x140 sk_reuseport_attach_bpf+0xc8/0x100 sk_setsockopt+0x1181/0x1990 do_sock_setsockopt+0x12b/0x160 __sys_setsockopt+0x7b/0xc0 __x64_sys_setsockopt+0x1b/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-21683"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-31T12:15:29Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix bpf_sk_select_reuseport() memory leak\n\nAs pointed out in the original comment, lookup in sockmap can return a TCP\nESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_EBPF\nset before it was ESTABLISHED. In other words, a non-NULL sk_reuseport_cb\ndoes not imply a non-refcounted socket.\n\nDrop sk\u0027s reference in both error paths.\n\nunreferenced object 0xffff888101911800 (size 2048):\n comm \"test_progs\", pid 44109, jiffies 4297131437\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 80 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace (crc 9336483b):\n __kmalloc_noprof+0x3bf/0x560\n __reuseport_alloc+0x1d/0x40\n reuseport_alloc+0xca/0x150\n reuseport_attach_prog+0x87/0x140\n sk_reuseport_attach_bpf+0xc8/0x100\n sk_setsockopt+0x1181/0x1990\n do_sock_setsockopt+0x12b/0x160\n __sys_setsockopt+0x7b/0xc0\n __x64_sys_setsockopt+0x1b/0x30\n do_syscall_64+0x93/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e",
"id": "GHSA-fjfj-r96f-8hqw",
"modified": "2026-05-12T15:30:45Z",
"published": "2025-01-31T12:33:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21683"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0ab52a8ca6e156a64c51b5e7456cac9a0ebfd9bf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b02e70be498b138e9c21701c2f33f4018ca7cd5e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b3af60928ab9129befa65e6df0310d27300942bf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bb36838dac7bb334a3f3d7eb29875593ec9473fc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cccd51dd22574216e64e5d205489e634f86999f3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d0a3b3d1176d39218b8edb2a2d03164942ab9ccd"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Implementation
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Architecture and Design
Build and Compilation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.