CVE-2024-38603

drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()

Description

In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() pci_alloc_irq_vectors() allocates an irq vector. When devm_add_action() fails, the irq vector is not freed, which leads to a memory leak. Replace the devm_add_action with devm_add_action_or_reset to ensure the irq vector can be destroyed when it fails.

Category

5.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.05%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/1491a01ef5a98149048b12e208f6ed8e86ad10b9 patch
https://git.kernel.org/stable/c/a7678a16c25b6ece1667ac681e3e783ff3de7a6f patch
https://git.kernel.org/stable/c/2fcffaaf529d5fe3fdc6c0ee65a6f266b74de782 patch
https://git.kernel.org/stable/c/b1e86f1ef8fa796f8935be392457639f3a907d91 patch
https://git.kernel.org/stable/c/582c1aeee0a9e73010cf1c4cef338709860deeb0 patch

Frequently Asked Questions

What is the severity of CVE-2024-38603?
CVE-2024-38603 has been scored as a medium severity vulnerability.
How to fix CVE-2024-38603?
To fix CVE-2024-38603, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-38603 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-38603 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-38603?
CVE-2024-38603 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.