PT-2024-9806 · Linux+6 · Linux Kernel+6

Published

2024-04-28

·

Updated

2025-09-29

·

CVE-2024-38603

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)
Description: The issue is related to a memory leak in the Linux kernel, specifically in the hns3 component. When devm add action() fails, the irq vector allocated by pci alloc irq vectors() is not freed, leading to a memory leak. This can be resolved by replacing devm add action() with devm add action or reset() to ensure the irq vector can be destroyed when it fails. The vulnerability may allow an attacker to cause a denial of service.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2025_16880
ALT-PU-2024-10855
ALT-PU-2024-11524
ALT-PU-2024-13979
ALT-PU-2024-14046
BDU:2024-11580
CVE-2024-38603
MGASA-2024-0263
MGASA-2024-0266
OESA-2024-1838
OESA-2024-1839
OPENSUSE-SU-2024_2372-1
OPENSUSE-SU-2024_2394-1
SUSE-SU-2024:2372-1
SUSE-SU-2024:2394-1
SUSE-SU-2024:2571-1
SUSE-SU-2024:2896-1
SUSE-SU-2024:2939-1
SUSE-SU-2024:2973-1
SUSE-SU-2025:20008-1
SUSE-SU-2025:20028-1
USN-6949-1
USN-6949-2
USN-6952-1
USN-6952-2
USN-6955-1

Affected Products

Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu