Medium 5.5Published May 6, 2026

CVE-2026-43157octeontx2-af: CGX: fix bitmap leaks

Updated under an hour ago (Oct 27, 2026, 12:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: fix bitmap leaks The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap) are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit(). Unbinding and rebinding the driver therefore triggers kmemleak: unreferenced object (size 16): backtrace: rvu_alloc_bitmap cgx_probe Free both bitmaps during teardown.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e740003874edc13e468d19233f99787bedb4bb8e before ad8a13a45c5c24d0d32de9a1c3fd58498a675ece; from e740003874edc13e468d19233f99787bedb4bb8e before 013ac469596a0b8671e62d89c89ae0bd46bbe667; from e740003874edc13e468d19233f99787bedb4bb8e before ccef79af58b43787c25710c9da96651c6ddfe50f; from e740003874edc13e468d19233f99787bedb4bb8e before 6d389382ee655128056fbdab86baad8495ffbf33; from e740003874edc13e468d19233f99787bedb4bb8e before ccca14bbdcc25829d355b9f4d3249f43dadb71c1; from e740003874edc13e468d19233f99787bedb4bb8e before 3def995c4ede842adf509c410e92d09a0cedc965	CNA record
linux linux_kernel linux:linux_kernel	from 5.18 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/ad8a13a45c5c24d0d32de9a1c3fd58498a675ece	patch
https://git.kernel.org/stable/c/013ac469596a0b8671e62d89c89ae0bd46bbe667	patch
https://git.kernel.org/stable/c/ccef79af58b43787c25710c9da96651c6ddfe50f	patch
https://git.kernel.org/stable/c/6d389382ee655128056fbdab86baad8495ffbf33	patch
https://git.kernel.org/stable/c/ccca14bbdcc25829d355b9f4d3249f43dadb71c1	patch
https://git.kernel.org/stable/c/3def995c4ede842adf509c410e92d09a0cedc965	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.