CVE-2024-26993: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released. Fix the leak by adding an explicit kobject_put() call when kn is NULL.

Affected products

• Linux Linux Kernel: from 3.16.62, before 3.17 (fixed in 3.17); from 3.18.121, before 3.19 (fixed in 3.19); from 4.4.154, before 4.5 (fixed in 4.5); from 4.9.125, before 4.10 (fixed in 4.10); from 4.14.68, before 4.15 (fixed in 4.15); from 4.18.6, before 4.19 (fixed in 4.19); …

Published 2024-05-01. Last modified 2026-06-17.