LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46221: EDAC/versalnet: Fix device name memory leak

In the Linux kernel, the following vulnerability has been resolved: EDAC/versalnet: Fix device name memory leak The device name allocated via kzalloc() in init_one_mc() is assigned to dev->init_name but never freed on the normal removal path. device_register() copies init_name and then sets dev->init_name to NULL, so the name pointer becomes unreachable from the device. Thus leaking memory. Use a stack-local char array instead of using kzalloc() for name.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory leak in the EDAC/versalnet driver. A device name allocation can become unreachable during normal device removal. The sources do not describe data exposure, code execution, privilege escalation, or active exploitation. Business urgency appears low unless your fleet runs affected kernels with this driver path in use.

Executive priority

Treat as routine kernel maintenance unless asset inventory shows broad use of the affected driver path. There is no sourced evidence of active exploitation or high-impact compromise, but unpatched kernel memory leaks should still be folded into normal update cycles.

Technical view

init_one_mc() allocates a device name with kzalloc() and assigns it to dev->init_name. device_register() copies that name and clears dev->init_name, leaving the original allocation unreachable on normal removal. The referenced stable fixes replace the heap allocation with a stack-local character array.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions that include and exercise the EDAC/versalnet memory-controller driver path. The source bundle does not identify affected distributions, appliances, cloud images, or default remote attack surface.

Exploitation context

CISA KEV is false, and the provided sources do not report exploitation. The described issue is a memory leak on normal device lifecycle handling, not a documented remote compromise path. Trigger requirements and practical attacker control are not specified.

Researcher notes

The evidence is narrow and code-level. No CVSS, CWE, exploitability analysis, or distro matrix is provided. Validation should focus on driver presence, kernel lineage, and whether downstream kernels have backported the stack-local name fix.

Mitigation direction

  • Check Linux vendor or distribution advisories for CVE-2026-46221 coverage.
  • Update to a kernel containing the referenced stable fix when available.
  • Prioritize systems using the EDAC/versalnet driver or affected hardware paths.
  • Monitor kernel memory behavior if immediate patching is delayed.

Validation and detection

  • Inventory kernel versions against the affected ranges in the CVE source bundle.
  • Confirm whether the EDAC/versalnet driver is built, loaded, or used.
  • Verify patched systems include one of the referenced stable commits or downstream equivalent.
  • Review vendor changelogs for explicit CVE-2026-46221 backport confirmation.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46221 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd5fe2fec6c40dda03df8cc9b4a97de0b7e39f984, d5fe2fec6c40dda03df8cc9b4a97de0b7e39f984, d5fe2fec6c40dda03df8cc9b4a97de0b7e39f984unaffected
LinuxLinux6.18, 0, 6.18.32, 7.0.9, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.