Executive brief
A memory leak vulnerability was identified in the Linux kernel's USB driver for Cadence USBSSP devices. When the system fails to set up certain USB data streams, it fails to properly release previously allocated memory. Over time, this could lead to memory exhaustion, potentially impacting system stability or performance.
Technical details
A memory leak exists in the Linux kernel's USB cdnsp driver within the cdnsp_alloc_stream_info() function. The function allocates a stream context array (stream_ctx_array) using cdnsp_alloc_stream_ctx(), but the error handling path fails to free this specific array if subsequent stream ring allocations or mapping updates fail. While other components like stream rings are correctly cleaned up, the context array remains in memory. This is a local vulnerability that can be triggered during specific USB device initialization failures. Patches have been released across multiple stable kernel branches to ensure cdnsp_free_stream_ctx() is called during the cleanup sequence.
Affected products
- Linux Linux Kernel 5.12 to 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/3348f444a4ce43dd5c2d1aa41634cb6eff33aa64
- https://git.kernel.org/stable/c/37283f5a47127fbdea567749a2110766af53d18d
- https://git.kernel.org/stable/c/963075c4da0cd43b3d17b107c355e1eb0ee64a58
- https://git.kernel.org/stable/c/c00826e87bb75e14e0381b05da5f18ffd0241ab6
- https://git.kernel.org/stable/c/cb8e9391b7f4f77d112c51910cd7c355a337ef76
- https://git.kernel.org/stable/c/d9643bbe93a6aee24edee1a86e0303aa74bcd320
- https://git.kernel.org/stable/c/fde3c095e1d48e0ac3ab8bc32905da42fe58a36a