CVE-2026-68221: media: nuvoton: npcm-video: fix memory leaks in probe and remove
In the Linux kernel, the following vulnerability has been resolved:
media: nuvoton: npcm-video: fix memory leaks in probe and remove
npcmvideoprobe() allocates the npcmvideo structure with kzallocobj() but never frees it on any probe error path or in npcmvideoremove(), leaking the allocation on every failed probe and every normal unbind.
Additionally, when npcmvideosetupvideo() fails, the reserved memory association established by ofreservedmemdeviceinit() in npcmvideoinit() is not released, leaking the rmemassigneddevice entry on the global list.
Fix both by adding kfree(video) to all probe error paths and to npcmvideoremove(), and adding the missing ofreservedmemdevicerelease() call when npcmvideosetupvideo() fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the npcm-video driver so that when npcm_video_setup_video() fails, the reserved memory allocation established by of_reserved_mem_device_init() is released via of_reserved_mem_device_release(), and ensure kfree(video) is added to all probe error paths (and that normal unbind/remove also frees the allocated resources in npcm_video_remove()).
Linux kernel (media: nuvoton: npcm-video) free reserved memory on probe error paths and during remove = Add kfree(video) to all probe error paths and ensure of_reserved_mem_device_release() is called when npcm_video_setup_video() fails; add missing of_reserved_mem_device_release() call when npcm_video_setup_video() entry on the global list fails and during npcm_video_remove()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68221?
CVE-2026-68221 has a risk rating of 12, indicating a high severity in the context of Linux kernel vulnerabilities.
What does CVE-2026-68221 affect?
CVE-2026-68221 affects the Nuvoton NPCM video driver in the Linux kernel, specifically related to memory management.
How do I fix CVE-2026-68221?
To fix CVE-2026-68221, ensure that the Linux kernel is updated to the version that includes the patch addressing the memory leaks.
What are the consequences of not addressing CVE-2026-68221?
Failure to address CVE-2026-68221 may lead to memory leaks, which can degrade system performance and stability.
When was CVE-2026-68221 published?
CVE-2026-68221 was published on August 10, 2026.