CVE-2026-43375
MEDIUM EPSS 2.2%
Published May 8, 20261mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Published May 8, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. This driver takes a reference to the USB device during probe but does not to release it on probe failures. Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
2.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-401
Affected Products 5
References 3
- git.kernel.org https://git.kernel.org/stable/c/224a0d284c3caf1951302d1744a714784febed71
- git.kernel.org https://git.kernel.org/stable/c/3224990fb16a831aabc50b67c74f5d0074ce80dd
- git.kernel.org https://git.kernel.org/stable/c/ec9538f9b5cd1db5e8c612aa636b6119b6355c5d
Remediation
- git.kernel.org https://git.kernel.org/stable/c/224a0d284c3caf1951302d1744a714784febed71
- git.kernel.org https://git.kernel.org/stable/c/3224990fb16a831aabc50b67c74f5d0074ce80dd
- git.kernel.org https://git.kernel.org/stable/c/ec9538f9b5cd1db5e8c612aa636b6119b6355c5d