What is CVE-2026-52904?

CVE-2026-52904 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, classified as a Memory Leak flaw (CWE-401), affecting Linux kernel versions from 6.12 onward and patched in 6.12.86, 6.18.27, 7.0.4 and others. CVE-2026-52904 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-52904?

CVE-2026-52904 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-52904?

Yes, CVE-2026-52904 has been patched. Fixed versions include 6.12.86, 6.18.27, 7.0.4 and others. If you are running Linux kernel 6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-52904 actively exploited?

CVE-2026-52904 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Memory Leak (CWE-401)?

The product does not release memory after use, causing gradual resource exhaustion. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/401.html

CVE-2026-52904

Medium

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix nvkm_device leak on aperture removal failure When aperture_remove_conflicting_pci_devices() fails during probe, the error path returns directly without unwinding the nvkm_device that was just allocated by nvkm_device_pci_new(). This leaks both the device wrapper and the pci_enable_device() reference taken inside it. Jump to the existing fail_nvkm label so nvkm_device_del() runs and balances both. The leak was introduced when the intermediate nvkm_device_del() between detection and aperture removal was dropped in favor of creating the pci device once.

Package Linux Kernel

Published 2026-06-09

Last modified 2026-07-23

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-401

CVE-2026-52904 is a Memory Leak vulnerability

What is Memory Leak?

The product does not release memory after use, causing gradual resource exhaustion. Learn more on MITRE CWE

Affected versions

Linux kernel versions 6.12 and later are affected. Fixed in 6.12.86, 6.18.27, 7.0.4, 7.1 and their respective stable series.

Affected from

≥ 6.12

Fixed in

✓ 6.12.86 6.12.x ✓ 6.18.27 6.18.x ✓ 7.0.4 7.0.x ✓ 7.1

References

4 total

Kernel Git
https://git.kernel.org/stable/c/4404d7d2dda4f3cc84a8fb6ac5417a2afc3b22d6

Patch
Kernel Git
https://git.kernel.org/stable/c/5edd564ccb002ffc830e7818c1c4a992db774678

Patch
Kernel Git
https://git.kernel.org/stable/c/6597ff1d8de3f583be169587efeafd8af134e138

Patch
Kernel Git
https://git.kernel.org/stable/c/843c0247cf21364e33bb5a8ffc9af57107d04d05

Patch

Details

CVE ID CVE-2026-52904

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-06-09

Modified 2026-07-23

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-52904?

CVE-2026-52904 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as a Memory Leak flaw (CWE-401) . It affects Linux kernel versions from 6.12 onward and has been patched in 6.12.86, 6.18.27, 7.0.4 and others. CVE-2026-52904 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-52904?

CVE-2026-52904 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-52904?

Yes. CVE-2026-52904 has been patched. Fixed versions include 6.12.86, 6.18.27, 7.0.4 and others. If you are running Linux kernel 6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-52904 actively exploited?

No. CVE-2026-52904 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.