CVE-2023-52526

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix memory leak of LZMA global compressed deduplication

When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled (`-Ededupe`), I found some short-lived temporary pages weren't properly released, which could slowly cause unexpected OOMs hours later.

Let's fix it now (LZ4 and DEFLATE don't have this issue.)

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
Linux	Linux	>= 5c2a64252c5dc4cfe78e5b2a531c118894e3d155, < 6a5a8f0a9740f865693d5aa97a42cc4504538e18; >= 5c2a64252c5dc4cfe78e5b2a531c118894e3d155, < c955751cbf864cf2055117dd3fe7f780d2a57b56; >= 5c2a64252c5dc4cfe78e5b2a531c118894e3d155, < 75a5221630fe5aa3fedba7a06be618db0f79ba1e
Linux	Linux	6.1

References

Timeline

Published: Mar 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-525275.5In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Incl CVE-2023-525285.5In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg syz CVE-2023-525296.0In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occ CVE-2023-52537.5A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may al CVE-2023-525307.8In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_li CVE-2023-525317.8In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, s CVE-2023-525325.5In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type CVE-2023-525335.3In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosu CVE-2023-525345.9In ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote denial of service with no additio CVE-2023-525354.4In vsp driver, there is a possible missing verification incorrect input. This could lead to local denial of service with no additional execu CVE-2023-525364.4In faceid service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with Sys CVE-2023-525377.5Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will af