Executive brief
A vulnerability was identified in the Linux kernel's cx25821 media driver, which handles certain video capture hardware. A technical error in how the system sets up this hardware could lead to a 'resource leak,' where memory is reserved but never released if an error occurs. Over time, this could degrade system performance or lead to a system crash, potentially allowing a local user to disrupt operations.
Technical details
A resource leak (CWE-401) exists in the cx25821 video driver within the Linux kernel. Specifically, in the `cx25821_dev_setup()` function, the driver fails to call `release_mem_region()` if the subsequent `ioremap()` call fails. This leaves the memory region obtained by `cx25821_get_resources()` allocated indefinitely. An attacker with local access could potentially trigger this failure path to exhaust system resources, leading to a denial-of-service (DoS) condition. The issue has been resolved by adding the appropriate cleanup call in the error handling path.
Affected products
- Linux Linux Kernel 2.6.32 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-01-13: patched: Initial patch committed to mainline kernel.
References
- https://git.kernel.org/stable/c/071bfc6e723aabbbf08f0d439fb913cd01eb8de2
- https://git.kernel.org/stable/c/4010e596d23cda6de65acb14f7fd4ce8289f1d49
- https://git.kernel.org/stable/c/68cd8ac994cac38a305200f638b30e13c690753b
- https://git.kernel.org/stable/c/80ce3797dc99dae4ce8b939626b891c9eb85139f
- https://git.kernel.org/stable/c/9f1c926248bde95a77ca104ab525467470607836
- https://git.kernel.org/stable/c/b7210170b10e2d17f7a4f6b9d39cc092442db860
- https://git.kernel.org/stable/c/e220ec4c4596d634685b8a08d79ad876a720b466