Executive brief
The Linux kernel's vme_user driver contains a memory leak in the Tundra TSI148 VME-PCI bridge removal path. When a device is unbound or the module is unloaded, allocated location monitor resources are not freed, causing memory to accumulate. This can lead to gradual system memory exhaustion and potential denial of service on systems using this driver.
Technical details
This is a resource leak vulnerability in the tsi148 driver's device removal function (tsi148_remove). The root cause is that tsi148_probe() allocates location monitor resources and links them into tsi148_bridge->lm_resources, but the remove function only frees DMA, slave, and master resource lists, leaving the location monitor list unfreed. The vulnerability affects kernel module unload and device hotplug/unbind scenarios—no special privileges or network access required. An attacker or unprivileged user with ability to load/unload the module or trigger device unbind events can repeatedly trigger the leak. The fix adds list traversal and kfree() calls in tsi148_remove() to properly deallocate lm_resources before tsi148_bridge is freed.
Affected products
- Linux Linux kernel all versions with vme_user/tsi148 driver (staging driver, multiple versions from 2.6.x through 7.x)
Timeline
- 2026-08-10: disclosed
- 2026-07-07: patched: Upstream fix committed 2026-07-04