Medium 5.5Published Mar 18, 2026

CVE-2026-23260regmap: maple: free entry on mas_store_gfp() failure

Updated under an hour ago (Oct 27, 2026, 10:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: regmap: maple: free entry on mas_store_gfp() failure regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails, the new 'entry' remains allocated and is never freed, leaking memory. Free 'entry' on the failure path; on success continue freeing the replaced neighbor blocks ('lower', 'upper').

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f033c26de5a5734625d2dd1dc196745fae186f1b before d61171cf097156030142643942c217759a9cc806; from f033c26de5a5734625d2dd1dc196745fae186f1b before 811b45e2d795d955bb7fd9c816b40036f4fde350; from f033c26de5a5734625d2dd1dc196745fae186f1b before f08f2d2907675926ac5657b25f86d921f269602a; from f033c26de5a5734625d2dd1dc196745fae186f1b before f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8	CNA record
linux linux_kernel linux:linux_kernel	from 6.4 before 6.6.124; from 6.7 before 6.12.70; from 6.13 before 6.18.10; 6.19; 6.19; 6.19; 6.19; 6.19; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d61171cf097156030142643942c217759a9cc806	patch
https://git.kernel.org/stable/c/811b45e2d795d955bb7fd9c816b40036f4fde350	patch
https://git.kernel.org/stable/c/f08f2d2907675926ac5657b25f86d921f269602a	patch
https://git.kernel.org/stable/c/f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.