Missing Release of Resource after Effective Lifetime The advisory has been revoked - it doesn't affect any version of package bpftool  (opens in a new tab)

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

Note: Versions mentioned in the description apply only to the upstream bpftool package and not the bpftool package as distributed by RHEL.

In the Linux kernel, the following vulnerability has been resolved:

coresight: Fix memory leak in acpi_buffer->pointer

There are memory leaks reported by kmemleak: ... unreferenced object 0xffff00213c141000 (size 1024): comm "systemd-udevd", pid 2123, jiffies 4294909467 (age 6062.160s) hex dump (first 32 bytes): 04 00 00 00 02 00 00 00 18 10 14 3c 21 00 ff ff ...........<!... 00 00 00 00 00 00 00 00 03 00 00 00 10 00 00 00 ................ backtrace: [<000000004b7c9001>] __kmem_cache_alloc_node+0x2f8/0x348 [<00000000b0fc7ceb>] __kmalloc+0x58/0x108 [<0000000064ff4695>] acpi_os_allocate+0x2c/0x68 [<000000007d57d116>] acpi_ut_initialize_buffer+0x54/0xe0 [<0000000024583908>] acpi_evaluate_object+0x388/0x438 [<0000000017b2e72b>] acpi_evaluate_object_typed+0xe8/0x240 [<000000005df0eac2>] coresight_get_platform_data+0x1b4/0x988 [coresight] ...

The ACPI buffer memory (buf.pointer) should be freed. But the buffer is also used after returning from acpi_get_dsd_graph(). Move the temporary variables buf to acpi_coresight_parse_graph(), and free it before the function return to prevent memory leak.

• https://access.redhat.com/security/cve/CVE-2023-53261
• https://git.kernel.org/stable/c/1a9e02673e2550f5612099e64e8761f0c8fc0f50
• https://git.kernel.org/stable/c/d1b60e7c9fee34eaedf1fc4e0471f75b33f83a4a
• https://git.kernel.org/stable/c/10bbb7efcad40a06d7acfc0a14af21c19b496eff