Junglewise Threat Intelligence

CVE-2026-68084: Linux kernel vme_user location monitor resource leak in tsi148 bridge

CVE-2026-68084 · Severity: info · Published 2026-08-10

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's vme_user driver contains a memory leak in the Tundra TSI148 VME-PCI bridge removal path. When a device is unbound or the module is unloaded, allocated location monitor resources are not freed, causing memory to accumulate. This can lead to gradual system memory exhaustion and potential denial of service on systems using this driver.

Technical details

This is a resource leak vulnerability in the tsi148 driver's device removal function (tsi148_remove). The root cause is that tsi148_probe() allocates location monitor resources and links them into tsi148_bridge->lm_resources, but the remove function only frees DMA, slave, and master resource lists, leaving the location monitor list unfreed. The vulnerability affects kernel module unload and device hotplug/unbind scenarios—no special privileges or network access required. An attacker or unprivileged user with ability to load/unload the module or trigger device unbind events can repeatedly trigger the leak. The fix adds list traversal and kfree() calls in tsi148_remove() to properly deallocate lm_resources before tsi148_bridge is freed.

Affected products

  • Linux Linux kernel all versions with vme_user/tsi148 driver (staging driver, multiple versions from 2.6.x through 7.x)

Timeline

  • 2026-08-10: disclosed
  • 2026-07-07: patched: Upstream fix committed 2026-07-04

References

Related threats