CVE-2026-99023

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99023", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.386Z", "datePublished": "2026-10-23T12:21:06.818Z", "dateUpdated": "2026-10-23T12:21:06.818Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:21:06.818Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()\n\nof_regulator_bulk_get_all() allocates the consumers array and hands it to\nthe caller, who is expected to free it at an appropriate time.\npwrseq-pcie-m2.c never did, leading to a memory leak.\n\nAdd an explicit kfree() for the consumers array."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/sequencing/pwrseq-pcie-m2.c"], "versions": [{"version": "52e7b5bd62bab3851f25d8b70ad7eae9e94aba60", "lessThan": "5cd2354ebfbd35bcb88d01fe7d3ee08dcf266eff", "status": "affected", "versionType": "git"}, {"version": "52e7b5bd62bab3851f25d8b70ad7eae9e94aba60", "lessThan": "0d6c5794fd633427f0d4ad8b51d94061295649da", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/sequencing/pwrseq-pcie-m2.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5cd2354ebfbd35bcb88d01fe7d3ee08dcf266eff"}, {"url": "https://git.kernel.org/stable/c/0d6c5794fd633427f0d4ad8b51d94061295649da"}], "title": "power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/power/sequencing/pwrseq-pcie-m2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5cd2354ebfbd35bcb88d01fe7d3ee08dcf266eff", "status": "affected", "version": "52e7b5bd62bab3851f25d8b70ad7eae9e94aba60", "versionType": "git"}, {"lessThan": "0d6c5794fd633427f0d4ad8b51d94061295649da", "status": "affected", "version": "52e7b5bd62bab3851f25d8b70ad7eae9e94aba60", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/power/sequencing/pwrseq-pcie-m2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()\n\nof_regulator_bulk_get_all() allocates the consumers array and hands it to\nthe caller, who is expected to free it at an appropriate time.\npwrseq-pcie-m2.c never did, leading to a memory leak.\n\nAdd an explicit kfree() for the consumers array."}], "id": "CVE-2026-99023", "lastModified": "2026-10-23T13:17:25.247", "metrics": {}, "published": "2026-10-23T13:17:25.247", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0d6c5794fd633427f0d4ad8b51d94061295649da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5cd2354ebfbd35bcb88d01fe7d3ee08dcf266eff"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", "id": "2559778", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559778"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\npower: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()\nof_regulator_bulk_get_all() allocates the consumers array and hands it to\nthe caller, who is expected to free it at an appropriate time.\npwrseq-pcie-m2.c never did, leading to a memory leak.\nAdd an explicit kfree() for the consumers array.", "A flaw was found in the Linux kernel's PCIe M.2 power sequencing driver. The driver fails to release memory allocated for regulator consumer arrays during error handling and device removal. A local attacker could exploit this issue by triggering repeated device probe failures or removal operations, resulting in a memory leak that can cause a Denial of Service (DoS) through system memory exhaustion."], "name": "CVE-2026-99023", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99023\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99023\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99023.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52e7b5bd62bab3851f25d8b70ad7eae9e94aba60,5cd2354ebfbd35bcb88d01fe7d3ee08dcf266eff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52e7b5bd62bab3851f25d8b70ad7eae9e94aba60,0d6c5794fd633427f0d4ad8b51d94061295649da)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52e7b5bd62bab3851f25d8b70ad7eae9e94aba60,5cd2354ebfbd35bcb88d01fe7d3ee08dcf266eff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52e7b5bd62bab3851f25d8b70ad7eae9e94aba60,0d6c5794fd633427f0d4ad8b51d94061295649da)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:30:14.845812+00:00", "updated": "2026-10-29T19:15:08.626156+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}