CVE-2026-45928: media: chips-media: wave5: Fix memory leak on codec_info allocation failure
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Fix memory leak on codecinfo allocation failure
In wave5vpuopenenc() and wave5vpuopendec(), a vpu instance is allocated via kzalloc(). If the subsequent allocation for inst->codecinfo fails, the functions return -ENOMEM without freeing the previously allocated instance, causing a memory leak.
Fix this by calling kfree() on the instance in this error path to ensure it is properly released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In wave5_vpu_open_enc() and wave5_vpu_open_dec(), when the subsequent allocation for inst->codec_info fails and the function returns -ENOMEM, free the previously allocated vpu instance by calling kfree() so the instance is properly released.
Linux kernel (media: chips-media: wave5) Memory management in wave5_vpu_open_enc()/wave5_vpu_open_dec() error path = Call kfree() on the vpu instance when inst->codec_info allocation fails (kzalloc()/allocation returns error and function returns -ENOMEM)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45928?
CVE-2026-45928 has a medium severity rating of 5.5 based on the CVSS 3.1 metrics.
How do I fix CVE-2026-45928?
To fix CVE-2026-45928, ensure that you update your Linux kernel to the patched version that addresses the memory leak issue.
What systems are affected by CVE-2026-45928?
CVE-2026-45928 affects Linux kernel versions that utilize the chips-media wave5 component.
What potential impact does CVE-2026-45928 have?
The potential impact of CVE-2026-45928 includes memory leaks that could lead to resource exhaustion and stability issues.
When was CVE-2026-45928 published?
CVE-2026-45928 was published on May 27, 2026.