CVE-2026-45900crypto: caam - fix netdev memory leak in dpaa2_caam_probe
- 5.5MediumCVSS base score
- 0.16%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix netdev memory leak in dpaa2_caam_probe When commit 0e1a4d427f58 ("crypto: caam: Unembed net_dev structure in dpaa2") converted embedded net_device to dynamically allocated pointers, it added cleanup in dpaa2_dpseci_disable() but missed adding cleanup in dpaa2_dpseci_free() for error paths. This causes memory leaks when dpaa2_dpseci_dpio_setup() fails during probe due to DPIO devices not being ready yet. The kernel's deferred probe mechanism handles the retry successfully, but the netdevs allocated during the failed probe attempt are never freed, resulting in kmemleak reports showing multiple leaked netdev-related allocations all traced back to dpaa2_caam_probe(). Fix this by preserving the CPU mask of allocated netdevs during setup and using it for cleanup in dpaa2_dpseci_free(). This approach ensures that only the CPUs that actually had netdevs allocated will be cleaned up, avoiding potential issues with CPU hotplug scenarios.
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Undergoing Analysis | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 0e1a4d427f58b843864d835ccb79c32a118c6a77 – < d5c6f254528caf78d5de7d9646dc21c81d351827
- affected 0e1a4d427f58b843864d835ccb79c32a118c6a77 – < d7decb572b55d2af33e59e9858fcee5d9ae69175
- affected 0e1a4d427f58b843864d835ccb79c32a118c6a77 – < e144cce29851610ce9c6eda405ce21118779aa51
- affected 0e1a4d427f58b843864d835ccb79c32a118c6a77 – < 7d43252b3060b0ba4a192dce5dba85a3f39ffe39
- affected 6.11
- unaffected < 6.11
- unaffected 6.12.75 – ≤ 6.12.*
- unaffected 6.18.14 – ≤ 6.18.*
- unaffected 6.19.4 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References4
- https://git.kernel.org/stable/c/d5c6f254528caf78d5de7d9646dc21c81d351827 (opens in a new tab)
- https://git.kernel.org/stable/c/d7decb572b55d2af33e59e9858fcee5d9ae69175 (opens in a new tab)
- https://git.kernel.org/stable/c/e144cce29851610ce9c6eda405ce21118779aa51 (opens in a new tab)
- https://git.kernel.org/stable/c/7d43252b3060b0ba4a192dce5dba85a3f39ffe39 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32366 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-45900)Record last updated .