What is CVE-2024-35972?

CVE-2024-35972 is a medium-severity vulnerability in Linux, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2024-05-20.

How severe is CVE-2024-35972?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Linux

CVE-2024-35972

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() If ulp = kzalloc() fails, the allocated edev will leak because it is not properly assigned and the cleanup path will not be able to free it. Fix it by assigning it properly immediately after allocation.

EPSS: 0.002 (13.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Linux — versions 30343221132430c24b468493c861f71e2bad131f, 6.3, 0
Linux Linux_kernel

Weakness classification (CWE)

CWE-401 — Missing Release of Memory after Effective Lifetime

References

416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)

Frequently asked questions

What is CVE-2024-35972?: CVE-2024-35972 is a medium-severity vulnerability in Linux, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2024-05-20.
How severe is CVE-2024-35972?: Medium severity. CVSS v3 base score is 5.5 out of 10.