CVE-2026-68223: media: meson: vdec: Fix memory leak in error path of vdec_open
In the Linux kernel, the following vulnerability has been resolved:
media: meson: vdec: Fix memory leak in error path of vdecopen
The vdecopen() function previously jumped directly to errm2mrelease when vdecinitctrls() failed, skipping release of the m2m context. This caused a resource leak.
Fix it by introducing a proper errm2mctxrelease label that calls v4l2m2mctxrelease(sess->m2mctx) before releasing the m2m device.
This was identified via kmemleak: unreferenced object 0xffff0000205d6878 (size 8): comm "v4lid", pid 5289, jiffies 4294938580 hex dump (first 8 bytes): 40 d2 49 18 00 00 ff ff @.I..... backtrace (crc d3204599): kmemleakalloc+0xc8/0xf0 kvmallocnodenoprof+0x60c/0x850 v4l2ctrlhandlerinitclass+0x1b4/0x2e8 [videodev] vdecopen+0x1f4/0x788 [mesonvdec] v4l2open+0x144/0x460 [videodev] chrdevopen+0x1ac/0x500 dodentryopen+0x3f0/0xfe8 vfsopen+0x68/0x320 doopen+0x2d8/0x9a8 pathopenat+0x1d0/0x4f0 dofilpopen+0x190/0x380 dosysopenat2+0xf8/0x1b0 arm64sysopenat+0x13c/0x1e8 invokesyscall+0xdc/0x268 el0svccommon.constprop.0+0x178/0x258 doel0svc+0x4c/0x70
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the resource leak in vdec_open() error path by introducing a proper err_m2m_ctx_release label so that when vdec_init_ctrls() fails, the code calls v4l2_m2m_ctx_release(sess->m2m_ctx) before releasing the m2m device (this prevents skipping the context release).
Linux kernel (media: meson: vdec) err_m2m_ctx_release label introduced; ensure v4l2_m2m_ctx_release(sess->m2m_ctx) is called on error path = apply code change so error path calls v4l2_m2m_ctx_release before releasing the m2m device
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68223?
CVE-2026-68223 has a risk rating of 5.
What is CVE-2026-68223 about?
CVE-2026-68223 addresses a memory leak in the vdec_open function within the Linux kernel's media framework.
How do I fix CVE-2026-68223?
To fix CVE-2026-68223, update your Linux kernel to the version that includes the patch for this vulnerability.
What are the consequences of CVE-2026-68223?
The consequences of CVE-2026-68223 include potential resource leaks that can affect system performance and stability.
Which component is affected by CVE-2026-68223?
CVE-2026-68223 affects the media subsystem, specifically the meson video decoder in the Linux kernel.