Executive brief
A vulnerability in the Linux kernel's MOST (Media Oriented Systems Transport) driver could allow a local user to cause a resource leak. This occurs when the system fails to properly clean up memory during certain error conditions when registering hardware interfaces. Over time, this could lead to system instability or a denial-of-service condition as available memory is exhausted.
Technical details
A memory leak vulnerability exists in the Linux kernel's MOST (Media Oriented Systems Transport) subsystem within 'drivers/most/core.c'. The function 'most_register_interface()' failed to release allocated memory and device IDs if an error occurred early in the registration process, specifically before 'device_register()' was called. An attacker with local access could potentially trigger these error paths to exhaust system memory (CWE-401). The fix involves refactoring the initialization to use 'device_initialize()' early and ensuring 'put_device()' is called on all error paths to trigger the appropriate release callbacks ('release_mdev' or 'dim2_release'). The registration logic was also updated to use 'device_add()' instead of 'device_register()' to support this split initialization.
Affected products
- Linux Linux Kernel 5.6 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-11-27: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-12: advisory: NVD enrichment and analysis completed