CVE-2026-45964

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A kref leak exists in the SUNRPC component. In the gss alloc msg() function, a kref get(&gss auth->kref) call was implemented to balance the gss put auth() operation performed in gss release msg(). However, the corresponding kref put() was omitted from the error path triggered when kstrdup const() fails. If the service name variable is non-NULL and kstrdup const() fails, the execution jumps to err put pipe version, which executes put pipe version() and kfree(gss msg) but fails to release the gss auth reference. This results in a kref leak, preventing the gss auth structure from being freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.