Medium 5.5Published May 1, 2024

CVE-2024-26993fs: sysfs: Fix reference leak in sysfs_break_active_protection()

Updated under an hour ago (Oct 26, 2026, 4:40 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released. Fix the leak by adding an explicit kobject_put() call when kn is NULL.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2afc9166f79b8f6da5f347f48515215ceee4ae37 before f28bba37fe244889b81bb5c508d3f6e5c6e342c5; from 2afc9166f79b8f6da5f347f48515215ceee4ae37 before 57baab0f376bec8f54b0fe6beb8f77a57c228063; from 2afc9166f79b8f6da5f347f48515215ceee4ae37 before 84bd4c2ae9c3d0a7d3a5c032ea7efff17af17e17; from 2afc9166f79b8f6da5f347f48515215ceee4ae37 before 43f00210cb257bcb0387e8caeb4b46375d67f30c; from 2afc9166f79b8f6da5f347f48515215ceee4ae37 before 5d43e072285e81b0b63cee7189b3357c7768a43b; from 2afc9166f79b8f6da5f347f48515215ceee4ae37 before ac107356aabc362aaeb77463e814fc067a5d3957; from 2afc9166f79b8f6da5f347f48515215ceee4ae37 before a4c99b57d43bab45225ba92d574a8683f9edc8e4; from 2afc9166f79b8f6da5f347f48515215ceee4ae37 before a90bca2228c0646fc29a72689d308e5fe03e6d78; and 12 more ranges	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.1	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	all versions not affected	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.1	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.16.62 before 3.17; from 3.18.121 before 3.19; from 4.4.154 before 4.5; from 4.9.125 before 4.10; from 4.14.68 before 4.15; from 4.18.6 before 4.19; from 4.19 before 5.15.157; from 5.16 before 6.1.88; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/f28bba37fe244889b81bb5c508d3f6e5c6e342c5	patch
https://git.kernel.org/stable/c/57baab0f376bec8f54b0fe6beb8f77a57c228063	patch
https://git.kernel.org/stable/c/84bd4c2ae9c3d0a7d3a5c032ea7efff17af17e17	patch
https://git.kernel.org/stable/c/43f00210cb257bcb0387e8caeb4b46375d67f30c	patch
https://git.kernel.org/stable/c/5d43e072285e81b0b63cee7189b3357c7768a43b	patch
https://git.kernel.org/stable/c/ac107356aabc362aaeb77463e814fc067a5d3957	patch
https://git.kernel.org/stable/c/a4c99b57d43bab45225ba92d574a8683f9edc8e4	patch
https://git.kernel.org/stable/c/a90bca2228c0646fc29a72689d308e5fe03e6d78	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html	mailing-list, third-party-advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html	mailing-list, third-party-advisory
1–10 of 15

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.