Executive brief
A memory leak vulnerability was identified in the Linux kernel's NVIDIA Tegra video driver. This component is responsible for handling video capture and processing on Tegra-based hardware. An attacker with local access could exploit this flaw to exhaust system memory, potentially leading to a system crash or service outage.
Technical details
A memory leak exists in the Linux kernel's media/tegra-video driver within the __tegra_channel_try_format() function. The vulnerability is caused by improper error handling where the 'sd_state' object, allocated via __v4l2_subdev_state_alloc(), is not released if v4l2_subdev_call() fails. This occurs in two specific error paths that return directly instead of proceeding to a cleanup routine. A local attacker with sufficient privileges to interact with the video device could repeatedly trigger these error paths to exhaust kernel memory, leading to a denial of service (DoS). The issue has been resolved by introducing a cleanup label and ensuring __v4l2_subdev_state_free() is called before returning.
Affected products
- Linux Linux Kernel 5.10 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.6
Timeline
- 2026-05-06: advisory: CVE-2026-43162 published by kernel.org
- 2026-01-13: patched: Initial patch committed to the Linux kernel tree
References
- https://git.kernel.org/stable/c/2dff8966a3a889dd9d248a7e15d963b4097efcc5
- https://git.kernel.org/stable/c/3ca2f09061736e72ef25eec2597d00f7f44094d3
- https://git.kernel.org/stable/c/43e5302d22334f1183dec3e0d5d8007eefe2817c
- https://git.kernel.org/stable/c/6c6f419fa9c44a4b7149b0292e01bff47308ba14
- https://git.kernel.org/stable/c/ca921be7a1174d5d58b28f84b683c2c0079f18c5
- https://git.kernel.org/stable/c/d92e9a18f97a1d19d4c2ff81dcfbe43591f75b5a