---
id: CVE-2024-56712
title: 'udmabuf: fix memory leak on last export_udmabuf() error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  udmabuf: fix memory leak on last export_udmabuf() error path

  In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a
  dma_buf owning the udmabuf has …
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 <
    00ebdef47994206f60546929a0f6f63285497272
  - >-
    Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 <
    e469922fbdf6ad729e5dc8d49289b5036a0ecdf8
  - >-
    Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 <
    c9fc8428d4255c2128da9c4d5cd92e554d0150cf
  - >-
    Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 <
    f49856f525acd5bef52ae28b7da2e001bbe7439e
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-04-17T20:10:27.510565Z'
published: '2024-12-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:20:26.741Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-56712'
references:
  - url: 'https://git.kernel.org/stable/c/00ebdef47994206f60546929a0f6f63285497272'
  - url: 'https://git.kernel.org/stable/c/e469922fbdf6ad729e5dc8d49289b5036a0ecdf8'
  - url: 'https://git.kernel.org/stable/c/c9fc8428d4255c2128da9c4d5cd92e554d0150cf'
  - url: 'https://git.kernel.org/stable/c/f49856f525acd5bef52ae28b7da2e001bbe7439e'
tags:
  - cve.org
epss: 0.0025
epssPercentile: 0.16454
ingestedAt: '2026-10-21T12:48:53.723Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

udmabuf: fix memory leak on last export_udmabuf() error path

In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a
dma_buf owning the udmabuf has already been created; but the error handling
in udmabuf_create() will tear down the udmabuf without doing anything about
the containing dma_buf.

This leaves a dma_buf in memory that contains a dangling pointer; though
that doesn't seem to lead to anything bad except a memory leak.

Fix it by moving the dma_buf_fd() call out of export_udmabuf() so that we
can give it different error handling.

Note that the shape of this code changed a lot in commit 5e72b2b41a21
("udmabuf: convert udmabuf driver to use folios"); but the memory leak
seems to have existed since the introduction of udmabuf.

## Affected

- `Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < 00ebdef47994206f60546929a0f6f63285497272`
- `Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < e469922fbdf6ad729e5dc8d49289b5036a0ecdf8`
- `Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < c9fc8428d4255c2128da9c4d5cd92e554d0150cf`
- `Linux >= fbb0de795078190a9834b3409e4b009cfb18a6d4 < f49856f525acd5bef52ae28b7da2e001bbe7439e`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.