{"cve":"CVE-2026-97606","nvd":{"published":"2026-09-25T11:17:14.657","modified":"2026-10-19T10:17:30.503","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: autofs: fix memory leak in autofs_fill_super()\n\nIn autofs_fill_super(), we create a new inode using\nautofs_new_ino(), however, if we fail to create root_inode,\n(that is, root_inode failure path), we return -ENOMEM without\nfreeing the new inode(ino) that we created causing a memory leak.\nFix this by adding autofs_free_ino() to free the inode we created\nin root_inode failure path before returning ENOMEM.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/4262b91e08e74cb5209ea737c554cf983d332382","https://git.kernel.org/stable/c/5ab54837fce04a1c9923d0bfd3d5de51fdc768b3","https://git.kernel.org/stable/c/6259b5d9bdc45fdb3158406b28c27fa074823159","https://git.kernel.org/stable/c/9933ad1c4ff67680cd59c47f6d2e81b533bcd467"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-97606","score":0.00206,"percentile":0.10462,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}