Not yet scoredPublished Jul 19, 2026

CVE-2026-63839platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()

Updated under an hour ago (Oct 28, 2026, 6:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() lwmi_dev_evaluate_int() leaks output.pointer when retval == NULL (found by sashiko.dev [1]). Fix it by moving `ret_obj = output.pointer' outside of the `if (retval)' block so that it is always freed by the __free cleanup callback. No functional change intended.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Sep 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e521d16e76cd9ea99c585e064f4e7daf657b1451 before ce493f9261cd3f4bffe2f72481d8c3ee01c559a3; from e521d16e76cd9ea99c585e064f4e7daf657b1451 before 40a984dd0602e238ad893b167751620e751d1199; from e521d16e76cd9ea99c585e064f4e7daf657b1451 before 0c3887a134f191723b53e2a47e501b534c8723ee	CNA record

References

References

https://git.kernel.org/stable/c/ce493f9261cd3f4bffe2f72481d8c3ee01c559a3
https://git.kernel.org/stable/c/40a984dd0602e238ad893b167751620e751d1199
https://git.kernel.org/stable/c/0c3887a134f191723b53e2a47e501b534c8723ee

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.