Common Weakness Enumeration
CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2026 vulnerabilities reference this CWE, most recent first.
GHSA-H5PV-V4MG-79M7
Vulnerability from github – Published: 2022-12-02 18:30 – Updated: 2025-11-03 21:30
VLAI
Details
DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-43272"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-02T16:15:00Z",
"severity": "HIGH"
},
"details": "DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object.",
"id": "GHSA-h5pv-v4mg-79m7",
"modified": "2025-11-03T21:30:45Z",
"published": "2022-12-02T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43272"
},
{
"type": "WEB",
"url": "https://github.com/songxpu/bug_report/tree/master/DCMTK/memory_leak_in_3.6.7"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00032.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HROBSUUV2LZCYUNODI2YM7G7AYYO75B"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3QG7MSHORLYAHDXMYG6FQKU4GOCRBCR"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMQ2USESKF6OAZAH64OFHNK2HJIJVGPP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HROBSUUV2LZCYUNODI2YM7G7AYYO75B"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3QG7MSHORLYAHDXMYG6FQKU4GOCRBCR"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMQ2USESKF6OAZAH64OFHNK2HJIJVGPP"
},
{
"type": "WEB",
"url": "https://www.wolai.com/vaVuMxU4gGqFakbzvc9NYw"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H5PX-P7WM-GQPV
Vulnerability from github – Published: 2024-04-17 12:32 – Updated: 2025-01-07 18:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
dm-integrity: fix a memory leak when rechecking the data
Memory for the "checksums" pointer will leak if the data is rechecked after checksum failure (because the associated kfree won't happen due to 'goto skip_io').
Fix this by freeing the checksums memory before recheck, and just use the "checksum_onstack" memory for storing checksum during recheck.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-26860"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-17T11:15:08Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix a memory leak when rechecking the data\n\nMemory for the \"checksums\" pointer will leak if the data is rechecked\nafter checksum failure (because the associated kfree won\u0027t happen due\nto \u0027goto skip_io\u0027).\n\nFix this by freeing the checksums memory before recheck, and just use\nthe \"checksum_onstack\" memory for storing checksum during recheck.",
"id": "GHSA-h5px-p7wm-gqpv",
"modified": "2025-01-07T18:30:42Z",
"published": "2024-04-17T12:32:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26860"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/20e21c3c0195d915f33bc7321ee6b362177bf5bf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/338580a7fb9b0930bb38098007e89cc0fc496bf7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/55e565c42dce81a4e49c13262d5bc4eb4c2e588a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6d35654f03c35c273240d85ec67e3f2c3596c4e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/74abc2fe09691f3d836d8a54d599ca71f1e4287b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H5WQ-3GV4-FHV7
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-03 21:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
driver core: location: Free struct acpi_pld_info *pld before return false
struct acpi_pld_info *pld should be freed before the return of allocation failure, to prevent memory leak, add the ACPI_FREE() to fix it.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-53211"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T15:15:47Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: location: Free struct acpi_pld_info *pld before return false\n\nstruct acpi_pld_info *pld should be freed before the return of allocation\nfailure, to prevent memory leak, add the ACPI_FREE() to fix it.",
"id": "GHSA-h5wq-3gv4-fhv7",
"modified": "2025-12-03T21:30:59Z",
"published": "2025-09-15T15:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53211"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0d150f967e8410e1e6712484543eec709356a65d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5a9de90951bbeaed775e4b8d1b16b4d359e82bf5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8fe72b8f59f63ca776bb8a4fcd2f406057a9fc90"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H659-9C3J-JCVG
Vulnerability from github – Published: 2023-02-27 06:30 – Updated: 2024-06-27 18:31
VLAI
Details
An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not released after it is allocated in dlt-control-common.c.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-26257"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-27T05:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not released after it is allocated in dlt-control-common.c.",
"id": "GHSA-h659-9c3j-jcvg",
"modified": "2024-06-27T18:31:29Z",
"published": "2023-02-27T06:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26257"
},
{
"type": "WEB",
"url": "https://github.com/COVESA/dlt-daemon/issues/440"
},
{
"type": "WEB",
"url": "https://github.com/COVESA/dlt-daemon/pull/441/commits/b6149e203f919c899fefc702a17fbb78bdec3700"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00021.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H675-FR46-XMW3
Vulnerability from github – Published: 2025-07-09 12:31 – Updated: 2025-11-19 21:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
memcg_path_store() assigns a newly allocated memory buffer to filter->memcg_path, without deallocating the previously allocated and assigned memory buffer. As a result, users can leak kernel memory by continuously writing a data to memcg_path DAMOS sysfs file. Fix the leak by deallocating the previously set memory buffer.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-38258"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-09T11:15:28Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-\u003ememcg_path on write\n\nmemcg_path_store() assigns a newly allocated memory buffer to\nfilter-\u003ememcg_path, without deallocating the previously allocated and\nassigned memory buffer. As a result, users can leak kernel memory by\ncontinuously writing a data to memcg_path DAMOS sysfs file. Fix the leak\nby deallocating the previously set memory buffer.",
"id": "GHSA-h675-fr46-xmw3",
"modified": "2025-11-19T21:31:15Z",
"published": "2025-07-09T12:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38258"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/490a43d07f1663d827e802720d30cbc0494e4f81"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4a158ac0538dd5695eeaa00aa0720d711f3e4ef1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f489fe6afb395dbc79840efa3c05440b760d883"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c5d5b0047b0c0f304608f3824139f7bd34c48413"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H6G6-QP55-M96Q
Vulnerability from github – Published: 2025-06-18 12:30 – Updated: 2025-11-13 21:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
cxl: Fix a memory leak in an error handling path
A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the error handling path of afu_allocate_irqs().
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-50025"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-18T11:15:30Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: Fix a memory leak in an error handling path\n\nA bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the\nerror handling path of afu_allocate_irqs().",
"id": "GHSA-h6g6-qp55-m96q",
"modified": "2025-11-13T21:31:17Z",
"published": "2025-06-18T12:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50025"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3a15b45b5454da862376b5d69a4967f5c6fa1368"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4be138bcd6d68cec0ce47051b117541061f5141a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6544ff559315498ad6c0a311359ca44987f9ca07"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/695af60af755873399ce01cb97176768828bc1fd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/89d51dc6878c47b6400922fac21b6a33f9d1a588"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/addff638c41753639368c252d0c5ba0d8fe9ed97"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c2557780ee7818b701681c226fa4cb7c0b171665"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c2c7a29f99788e9e5dfe41d16868ea33da7cc235"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H768-P74V-9G52
Vulnerability from github – Published: 2024-02-27 18:31 – Updated: 2024-08-29 21:31
VLAI
Details
Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-27508"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-27T16:15:47Z",
"severity": "HIGH"
},
"details": "Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.",
"id": "GHSA-h768-p74v-9g52",
"modified": "2024-08-29T21:31:01Z",
"published": "2024-02-27T18:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27508"
},
{
"type": "WEB",
"url": "https://github.com/LuMingYinDetect/Atheme_defects/blob/main/Atheme_detect_1.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H76C-M8M4-8VH3
Vulnerability from github – Published: 2025-10-01 12:30 – Updated: 2026-01-20 18:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
If device_register() fails in snd_ac97_dev_register(), it should call put_device() to give up reference, or the name allocated in dev_set_name() is leaked.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-50427"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-01T12:15:34Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ac97: fix possible memory leak in snd_ac97_dev_register()\n\nIf device_register() fails in snd_ac97_dev_register(), it should\ncall put_device() to give up reference, or the name allocated in\ndev_set_name() is leaked.",
"id": "GHSA-h76c-m8m4-8vh3",
"modified": "2026-01-20T18:31:51Z",
"published": "2025-10-01T12:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50427"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0f8e9a15c8ecf95057061d370a2dddaf1cee4aeb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4881bda5ea05c8c240fc8afeaa928e2bc43f61fa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4fdf6f978c6b605ca0d67bf0e982b7a8fc0f4aab"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/758dbcc6fbf2286eff02743b093c70a18a407d66"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a602ec9d88f177dba78bc97fb1adecc7a71ff279"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bfce73088682ef0770da951f51156c36a89be490"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c68b2e9ef246117f696e360bbdd2f5736b3a7127"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ee8bf0946f62ef00e5db4b613a9f664ac567259a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H772-36JH-J5R8
Vulnerability from github – Published: 2025-06-18 12:30 – Updated: 2025-11-17 21:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource
Unlike release_mem_region(), a call to release_resource() does not free the resource, so it has to be freed explicitly to avoid a memory leak.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-50110"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-18T11:15:40Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource\n\nUnlike release_mem_region(), a call to release_resource() does not\nfree the resource, so it has to be freed explicitly to avoid a memory\nleak.",
"id": "GHSA-h772-36jh-j5r8",
"modified": "2025-11-17T21:31:18Z",
"published": "2025-06-18T12:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50110"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3a1becb1f13268ef58f19190608a7c742fb6fcf5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/84ddf527f90755beec6b55ce2e31331f5ccd4e37"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c6d9c0798ed366a09a9e53d71edcd2266e34a6eb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ee1fb8f75abe361413913e3a6e93c8c0a4d83cd9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H7WJ-HH9R-8G9P
Vulnerability from github – Published: 2025-09-17 15:30 – Updated: 2025-12-11 15:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Fix slicing memory leak
The temporary buffer storing slicing configuration data from user is only freed on error. This is a memory leak. Free the buffer unconditionally.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-53350"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-17T15:15:38Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Fix slicing memory leak\n\nThe temporary buffer storing slicing configuration data from user is only\nfreed on error. This is a memory leak. Free the buffer unconditionally.",
"id": "GHSA-h7wj-hh9r-8g9p",
"modified": "2025-12-11T15:30:29Z",
"published": "2025-09-17T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53350"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2d956177b7c96e62fac762a3b7da4318cde27a73"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/df45c3e46cdb41f486eecb4277fbcc4c1ffbf9be"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Implementation
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Architecture and Design
Build and Compilation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.