Bug 2451184 (CVE-2026-23344) - CVE-2026-23344 kernel: crypto: ccp - Fix use-after-free on error path
Summary: CVE-2026-23344 kernel: crypto: ccp - Fix use-after-free on error path
Keywords:
Status: NEW
Alias: CVE-2026-23344
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-25 11:03 UTC by OSIDB Bzimport
Modified: 2026-03-25 17:38 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-25 11:03:23 UTC
In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Fix use-after-free on error path

In the error path of sev_tsm_init_locked(), the code dereferences 't'
after it has been freed with kfree(). The pr_err() statement attempts
to access t->tio_en and t->tio_init_done after the memory has been
released.

Move the pr_err() call before kfree(t) to access the fields while the
memory is still valid.

This issue reported by Smatch static analyser


Note You need to log in before you can comment on or make changes to this bug.