CVE-2026-68212: media: saa7134: Fix a possible memory leak in saa7134_video_init1
In the Linux kernel, the following vulnerability has been resolved:
media: saa7134: Fix a possible memory leak in saa7134videoinit1
In saa7134videoinit1(), the return value of the first saa7134pgtablealloc() is not checked. If it fails, the function continues as if successful, leaving the driver with an invalid page table. Additionally, if vb2queueinit() for the VBI queue fails after the video queue page table has been allocated, the allocated memory is not freed before returning. The second saa7134pgtablealloc() also lacks a return value check. Errors occur during device probing before the device is fully registered, the normal cleanup path in saa7134finidev() is not executed, leading to memory leaks and potential use of uninitialized DMA resources.
Check the return value of both saa7134pgtablealloc() calls and propagate errors. On failure of any later step, free allocated page tables to avoid memory leaks. Ensure control handlers are also released on error to prevent further resource leakage.
Found by code review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In saa7134_video_init1(), check the return value of vb2_queue_init() for the VBI queue; if it fails, propagate the error and stop further initialization so cleanup happens rather than continuing with invalid/uninitialized DMA resources.
Linux kernel (media: saa7134 driver) vb2_queue_init() return value handling = check return value and propagate errors on failure - Configuration
In saa7134_video_init1(), check the return value of the first and the second saa7134_pgtable_alloc() calls; on failure, stop initialization and ensure allocated page tables are freed rather than continuing as if successful.
Linux kernel (media: saa7134 driver) saa7134_pgtable_alloc() return value handling (two calls) = check return value of both saa7134_pgtable_alloc() calls - Configuration
In saa7134_video_init1(), ensure control handlers are also checked for success; on failure of any later step, free allocated page table memory before returning and do not leave the driver with invalid state.
Linux kernel (media: saa7134 driver) control handlers initialization/registration error handling = ensure control handlers are also checked - Operational
After updating to the fixed kernel code for 'media: saa7134: Fix a possible memory leak in saa7134_video_init1', ensure the normal cleanup path is executed on error (instead of continuing registration while saa7134_finidev() is skipped) to prevent memory leaks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68212?
CVE-2026-68212 has a risk severity rating of 12.
What is the main issue described in CVE-2026-68212?
CVE-2026-68212 addresses a possible memory leak in the saa7134_video_init1 function in the Linux kernel.
How does CVE-2026-68212 affect system performance?
CVE-2026-68212 can lead to reduced system performance due to potential memory leaks if the vulnerability is exploited.
Is CVE-2026-68212 present in all versions of the Linux kernel?
CVE-2026-68212 is not present in all versions; it specifically affects versions of the Linux kernel where the saa7134 driver is implemented.
How do I fix CVE-2026-68212?
To fix CVE-2026-68212, update your Linux kernel to the patched version that addresses the memory leak in the saa7134 driver.