cyfenced.com →

[ CVE-2026-97440 · Published 24 Sep 2026 ]

Vulnerability in Linux

Not scored yet EPSS <1%3 agency advisoriesNo fix listed yet

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix node refcount leak on ctrl packet alloc failure qrtr_send_resume_tx() calls qrtr_node_lookup() which takes a reference on the returned node. If the subsequent call to qrtr_alloc_ctrl_packet() fails due to memory allocation failure, the function returns -ENOMEM without calling qrtr_node_release() to release the node reference. Add qrtr_node_release(node) before returning on the allocation failure path to properly release the reference.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1289

    Multiple vulnerabilities in the Debian LTS Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Debian LTS Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

    CVE-2025-38237CVE-2025-39833CVE-2025-39925+1311 more CVEs
  • CERT-FRCERTFR-2026-AVI-1253

    Multiple vulnerabilities in the Debian Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Debian Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

    CVE-2025-38237CVE-2025-39833CVE-2025-39925+1310 more CVEs
  • BSI CERT-BundWID-SEC-2026-3579

    Linux Kernel: Multiple vulnerabilities Translated from German

    CVE-2026-97615CVE-2026-97978CVE-2026-98127+590 more CVEs

[ References ]References