Executive brief
A vulnerability was identified in the Linux kernel's MOST (Media Oriented Systems Transport) driver core. A flaw in how the system handles errors during device registration can lead to a resource leak, where system memory or interface resources are not properly released. This could potentially be used to degrade system performance or cause a denial-of-service over time.
Technical details
A resource leak exists in the 'most_register_interface' function within 'drivers/most/core.c'. The vulnerability occurs because an early error path failed to call 'put_device()' after 'device_initialize()' had been invoked, leaving resources associated with the interface allocated despite a registration failure. An attacker with the ability to trigger registration errors could cause a kernel resource exhaustion. The issue has been resolved by ensuring 'put_device()' is called in the initial validation error paths.
Affected products
- Linux Linux Kernel most: core component
Timeline
- 2026-01-16: patched: Initial patch authored by Johan Hovold
- 2026-05-08: disclosed: CVE published