Executive brief
The SM501 multifunction device driver in the Linux kernel fails to free allocated memory when the driver is removed or the device is unplugged. Over time, repeated removal and reinsertion of the device, or repeated driver load/unload cycles, can cause memory to accumulate and degrade system performance or availability.
Technical details
A memory leak exists in the SM501 multifunction device driver (drivers/mfd/sm501.c) where the struct sm501_devdata allocated in sm501_pci_probe() and sm501_plat_probe() is never freed by the corresponding removal functions sm501_pci_remove() and sm501_plat_remove(). The vulnerability requires local access to trigger device removal or driver unload. An attacker or unprivileged user with the ability to repeatedly remove/re-add the device or reload the driver module can exhaust kernel memory. The fix adds kfree() calls to both removal functions to properly deallocate the structure.
Affected products
- Linux Linux kernel affected versions prior to patch commit 83feedd9d83c0c5199f98c72df0a6196b4aefb4d
Timeline
- 2026-09-11: disclosed
- 2026-08-06: patched: Upstream patch merged