Medium 5.5Published Sep 16, 2025

CVE-2025-39830net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path

Updated under an hour ago (Oct 27, 2026, 1:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path In the error path of hws_pool_buddy_init(), the buddy allocator cleanup doesn't free the allocator structure itself, causing a memory leak. Add the missing kfree() to properly release all allocated memory.

CVSS: 5.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-401
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c61afff94373641695cc81999e9bb10408ea84d5 before 4ccdbf50dd88a2a7399409e68887dd8077f6a562; from c61afff94373641695cc81999e9bb10408ea84d5 before 86d13a6f49cb68aa91bd718b1b627e72e77285c1; from c61afff94373641695cc81999e9bb10408ea84d5 before 2c0a959bebdc1ada13cf9a8242f177c5400299e6	CNA record
linux linux_kernel linux:linux_kernel	from 6.12 before 6.16.5; 6.17; 6.17; 6.17	NVD

References

References

https://git.kernel.org/stable/c/4ccdbf50dd88a2a7399409e68887dd8077f6a562
https://git.kernel.org/stable/c/86d13a6f49cb68aa91bd718b1b627e72e77285c1	patch
https://git.kernel.org/stable/c/2c0a959bebdc1ada13cf9a8242f177c5400299e6	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.