CVE-2026-45881: soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
In the Linux kernel, the following vulnerability has been resolved:
soc: mediatek: svs: Fix memory leak in svsenabledebugwrite()
In svsenabledebugwrite(), the buf allocated by memdupusernul() is leaked if kstrtoint() fails.
Fix this by using free(kfree) to automatically free buf, eliminating the need for explicit kfree() calls and preventing leaks.
[Angelo: Added missing cleanup.h inclusion]
Affected Software
Event History
Frequently Asked Questions
Who can trigger the memory leak?
Systems are exposed only where the Linux kernel includes the MediaTek SVS subsystem and a local user can reach the svs_enable_debug_write() path. The CVSS vector indicates local access and low privileges are required; no user interaction is needed.
What input condition causes the leak?
The leak occurs when svs_enable_debug_write() allocates a buffer with memdup_user_nul() and the subsequent kstrtoint() conversion fails. Repeated malformed input reaching that error path could consume memory and affect availability.
What fixes the issue?
The resolved change automatically frees the allocated buffer on the kstrtoint() failure path using __free(kfree), with the required cleanup.h inclusion. Applying a kernel version containing one of the referenced stable fixes addresses the issue.