---
id: CVE-2026-63839
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()

  lwmi_dev_evaluate_int() leaks output.pointer when retval == NULL (found
  by sashiko.dev [1]…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()

  lwmi_dev_evaluate_int() leaks output.pointer when retval == NULL (found
  by sashiko.dev [1]…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e521d16e76cd9ea99c585e064f4e7daf657b1451 <
    ce493f9261cd3f4bffe2f72481d8c3ee01c559a3
  - >-
    Linux >= e521d16e76cd9ea99c585e064f4e7daf657b1451 <
    40a984dd0602e238ad893b167751620e751d1199
  - >-
    Linux >= e521d16e76cd9ea99c585e064f4e7daf657b1451 <
    0c3887a134f191723b53e2a47e501b534c8723ee
  - Linux 6.17
published: '2026-07-19'
updated: '2026-09-07'
sourceUpdated: '2026-09-07T16:17:28.937'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63839'
references:
  - url: 'https://git.kernel.org/stable/c/0c3887a134f191723b53e2a47e501b534c8723ee'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/40a984dd0602e238ad893b167751620e751d1199'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ce493f9261cd3f4bffe2f72481d8c3ee01c559a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00206
epssPercentile: 0.09515
ingestedAt: '2026-09-08T15:33:26.947Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()

lwmi_dev_evaluate_int() leaks output.pointer when retval == NULL (found
by sashiko.dev [1]).

Fix it by moving `ret_obj = output.pointer' outside of the `if (retval)'
block so that it is always freed by the __free cleanup callback.

No functional change intended.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.