Executive brief
A memory leak vulnerability was identified in the Linux kernel's National Instruments USB GPIB driver. This driver is used to facilitate communication between computers and laboratory instruments via USB. An exploit could lead to a gradual depletion of system memory, potentially causing system instability or a denial-of-service condition over time.
Technical details
A memory leak exists in the ni_usb_init() function within the National Instruments USB GPIB driver (drivers/gpib/ni_usb/ni_usb_gpib.c). When ni_usb_setup_init() fails, the function returns an error code (-EFAULT) without freeing the previously allocated 'writes' buffer. Additionally, ni_usb_setup_init() incorrectly returned 0 on failure instead of a proper negative error code. An attacker with the ability to trigger driver initialization failures could cause kernel memory exhaustion. The fix involves explicitly freeing the buffer in the error path and ensuring proper error code propagation (-EINVAL).
Affected products
- Linux Linux Kernel 4e127de14fa7
Timeline
- 2025-12-30: other: Patch submitted by developer
- 2026-05-27: advisory: CVE published
- 2026-02-26: patched: Patch committed to stable tree