Medium 5.5Published Apr 3, 2026

CVE-2026-23464soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe()

Updated under an hour ago (Oct 28, 2026, 5:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe() In mpfs_sys_controller_probe(), if of_get_mtd_device_by_node() fails, the function returns immediately without freeing the allocated memory for sys_controller, leading to a memory leak. Fix this by jumping to the out_free label to ensure the memory is properly freed. Also, consolidate the error handling for the mbox_request_channel() failure case to use the same label.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 742aa6c563d29c367edbf0ef7236a7a853ed9be4 before da4b44c42f40501db35f5d0a6243708a061490a0; from 742aa6c563d29c367edbf0ef7236a7a853ed9be4 before e3dd5cffba07de6574165a72851471cd42cc6d15; 742aa6c563d29c367edbf0ef7236a7a853ed9be4 builds before 17c84fb7cf3971cc621646185d785670e9530ca1; 742aa6c563d29c367edbf0ef7236a7a853ed9be4 builds before 5a741f8cc6fe62542f955cd8d24933a1b6589cbd	CNA record
linux linux_kernel linux:linux_kernel	from 6.8 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; 7.0; 7.0; 7.0	NVD

References

References

https://git.kernel.org/stable/c/da4b44c42f40501db35f5d0a6243708a061490a0	patch
https://git.kernel.org/stable/c/e3dd5cffba07de6574165a72851471cd42cc6d15	patch
https://git.kernel.org/stable/c/17c84fb7cf3971cc621646185d785670e9530ca1	patch
https://git.kernel.org/stable/c/5a741f8cc6fe62542f955cd8d24933a1b6589cbd	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.