CVE-2026-43317 json
most: core: fix leak on early registration failure
published 2026-05-08 6 mo ago modified 2026-10-21 18 d ago also EUVD-2026-28601
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
most: core: fix leak on early registration failure
A recent commit fixed a resource leak on early registration failures but for some reason left out the first error path which still leaks the resources associated with the interface.
Fix up also the first error path so that the interface is always released on errors.
Patch / fix
- Linux Linux 6.6.160, 6.12.75, 6.18.16, 6.19.6, 7.0
- linux Debian 13 6.12.85-1
- linux Debian 14 6.19.6-1
debian advisories DEBIAN-CVE-2026-43317
- linux Ubuntu 24.04 LTS 6.8.0-134.134
- linux-aws Ubuntu 24.04 LTS 6.8.0-1060.63
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1063.69
- linux-gke Ubuntu 24.04 LTS 6.8.0-1058.64
- linux-ibm Ubuntu 24.04 LTS 6.8.0-1060.61
- linux-azure Ubuntu 24.04 LTS 6.8.0-1063.71
- linux-gkeop Ubuntu 24.04 LTS 6.8.0-1045.48
- linux-raspi Ubuntu 24.04 LTS 6.8.0-1060.64
ubuntu advisories UBUNTU-CVE-2026-43317
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- git.kernel.org/stable/c/04474009a2ea7aa27c67d323952a23bb16d5acc5 commit
- git.kernel.org/stable/c/bbfe49ffb892bddf32c34bea95b7ff0fc30affb5 commit
- git.kernel.org/stable/c/f1ba620f9e8d7291f80c0554e4b820f5fb30e819 commit
- git.kernel.org/stable/c/5fd4396c2e48e90cc2597a86c18227d56ea845f0 commit
- git.kernel.org/stable/c/2c198c272f9c9213b0fdf6b4a879f445c574f416 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-43317 updated
kernel: most: core: fix leak on early registration failure
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernelnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.12% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Linux Linux
Classification
- Weakness
-
- CWE-401 Missing Release of Memory after Effective Lifetime
- Technology feeds
References
- git.kernel.org /stable/c/04474009a2ea7aa27c67d323952a23bb16d5acc5
-
git.kernel.org
/stable/c/bbfe49ffb892bddf32c34bea95b7ff0fc30affb5
patch
-
git.kernel.org
/stable/c/f1ba620f9e8d7291f80c0554e4b820f5fb30e819
patch
-
git.kernel.org
/stable/c/5fd4396c2e48e90cc2597a86c18227d56ea845f0
patch
-
git.kernel.org
/stable/c/2c198c272f9c9213b0fdf6b4a879f445c574f416
patch
Sources
- CVE List CVE-2026-43317
- NVD CVE-2026-43317
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.