https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 23:43:29 +0000 https://vulnerability.circl.lu/vuln/cve-2026-45964 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path</p> <p>Commit 5940d1cf9f42 (&#34;SUNRPC: Rebalance a kref in auth_gss.c&#34;) added a kref_get(&amp;gss_auth-&gt;kref) call to balance the gss_put_auth() done in gss_release_msg(), but forgot to add a corresponding kref_put() on the error path when kstrdup_const() fails.</p> <p>If service_name is non-NULL and kstrdup_const() fails, the function jumps to err_put_pipe_version which calls put_pipe_version() and kfree(gss_msg), but never releases the gss_auth reference. This leads to a kref leak where the gss_auth structure is never freed.</p> <p>Add a forward declaration for gss_free_callback() and call kref_put() in the err_put_pipe_version error path to properly release the reference taken earlier.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path</p> <p>Commit 5940d1cf9f42 (&#34;SUNRPC: Rebalance a kref in auth_gss.c&#34;) added a kref_get(&amp;gss_auth-&gt;kref) call to balance the gss_put_auth() done in gss_release_msg(), but forgot to add a corresponding kref_put() on the error path when kstrdup_const() fails.</p> <p>If service_name is non-NULL and kstrdup_const() fails, the function jumps to err_put_pipe_version which calls put_pipe_version() and kfree(gss_msg), but never releases the gss_auth reference. This leads to a kref leak where the gss_auth structure is never freed.</p> <p>Add a forward declaration for gss_free_callback() and call kref_put() in the err_put_pipe_version error path to properly release the reference taken earlier.</p> https://vulnerability.circl.lu/vuln/cve-2026-45964