Executive brief
The Linux kernel's Intel SAR (Specific Absorption Rate) driver for M.2 modems contains a memory leak in its initialization routine. When certain error conditions occur during device startup, memory allocated for device configuration information is not freed, gradually consuming system memory. This can lead to reduced system stability and performance over time, particularly on systems with many device attach/detach cycles.
Technical details
This vulnerability is a memory leak in the sar_probe() function of the Intel platform/x86 int1092 driver (drivers/platform/x86/intel/int1092/intel_sar.c). Memory is allocated in parse_package() via kmalloc_objs() for the device_mode_info array but is not freed when error paths in sar_probe() are taken (such as GUID parsing failures, device mode retrieval failures, or sysfs creation failures). The fix converts regular kzalloc/kmalloc allocations to device-managed allocations (devm_kzalloc, devm_kmalloc_array), which are automatically freed when the device is removed, ensuring no leak occurs regardless of which error path is taken. The vulnerability requires the int1092 driver to be loaded and the probe function to fail partway through initialization.
Affected products
- Linux Linux kernel Versions prior to fix commit 30c906cff490c3601ee9ff110fe8115fabe75fd4; affects drivers/platform/x86/intel/int1092
Timeline
- 2026-09-11: disclosed: Published to NVD
- 2026-07-24: patched: Upstream commit 30c906cff490c3601ee9ff110fe8115fabe75fd4 merged
- 2026-09-14: patched: Backported to stable kernels via commit 08dab7065f9369dd0a0aa740071bcd884c4848b0