CVE-2026-68203: media: vivid: fix cleanup bugs in vivid_init()
In the Linux kernel, the following vulnerability has been resolved:
media: vivid: fix cleanup bugs in vividinit()
When platformdeviceregister() fails in vividinit(), the embedded struct device in vividpdev has already been initialized by deviceinitialize(), but the failure path jumps to freeoutputstrings without dropping the device reference for the current platform device:
vividinit() -> platformdeviceregister(&vividpdev) -> deviceinitialize(&vividpdev.dev) -> setuppdevdmamasks(&vividpdev) -> platformdeviceadd(&vividpdev)
This leads to a reference leak when platformdeviceregister() fails. Fix this by calling platformdeviceput() before jumping to the common cleanup path.
Also, the unregdriver label incorrectly calls platformdriverregister() instead of platformdriverunregister(), which breaks cleanup when workqueue creation fails after successful driver registration. Fix that as well.
The reference leak was identified by a static analysis tool I developed and confirmed by manual review. The incorrect cleanup call was found during code inspection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68203?
CVE-2026-68203 has a risk score of 12, indicating a high severity level.
What systems are affected by CVE-2026-68203?
CVE-2026-68203 affects the Linux kernel specifically in the media handling component.
How do I fix CVE-2026-68203?
To fix CVE-2026-68203, ensure your Linux kernel is updated to include the patches addressing this vulnerability.
What type of vulnerability is CVE-2026-68203?
CVE-2026-68203 is related to cleanup bugs in the initialization process of a media device in the Linux kernel.
When was CVE-2026-68203 published?
CVE-2026-68203 was published on August 10, 2026.