CVE-2026-93071: media: bcm2835-unicam: Fix asc leaked in error/remove path
In the Linux kernel, the following vulnerability has been resolved:
media: bcm2835-unicam: Fix asc leaked in error/remove path
v4l2asyncnfaddfwnoderemote() allocates the asc, which is freed when v4l2asyncnfcleanup() is called.
Call v4l2asyncnfcleanup() properly in the driver paths.
Discovered with kmemleak after rmmod:
unreferenced object 0xffff000084526b80 (size 64): comm "modprobe", pid 185, jiffies 4295013512 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 e8 0d ff bf 00 00 ff ff ................ 40 83 bc 84 00 00 ff ff 60 83 bc 84 00 00 ff ff @.............. backtrace (crc ac584083): [<00000000ffb081a7>] kmemleakalloc+0x38/0x44 [<00000000d2fd9301>] kmalloc+0x1b0/0x250 [<000000004dd5354d>] v4l2asyncnfaddfwnode+0x28/0x9c [<0000000067587657>] v4l2asyncnfaddfwnoderemote+0x3c/0x64
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel media bcm2835-unicam driver, call v4l2_async_nf_cleanup() in the error and remove paths to free the async connection object allocated by v4l2_async_nf_add_fwnode_remote().
Event History
Frequently Asked Questions
When does the memory leak occur?
The leak occurs in bcm2835-unicam driver error and removal paths when an async connection structure allocated by v4l2_async_nf_add_fwnode_remote() is not cleaned up. It was observed with kmemleak after unloading the module with rmmod.
How can I determine whether a system is affected?
A system using the bcm2835-unicam driver may show a kmemleak report after module unload, with an unreferenced 64-byte allocation whose backtrace includes __v4l2_async_nf_add_fwnode and __v4l2_async_nf_add_fwnode_remote.
What is the remediation?
Apply a kernel update containing the driver change that properly calls v4l2_async_nf_cleanup() in the relevant error and removal paths. The provided references identify stable kernel commits containing the fix.