CVE-2024-27078

What it actually does

Memory leaks occur in tpg_alloc because resources allocated inside for loops are not released on every error return path, and tpg_free is only invoked on successful completion.

Why it matters to the business

Repeated triggering of allocation failures can gradually exhaust kernel memory on affected Linux systems, leading to degraded performance or denial of service for video-related workloads.

How an attack unfolds

An attacker with local access crafts conditions that cause tpg_alloc to fail partway through its allocation loops, leaving allocated buffers unreclaimed until the process or system restarts.

How to fix it

Upgrade the Linux kernel to a version containing commit 0de691ff547d86dd54c24b40a81f9c925df8dd77 or later that ensures proper deallocation on all error paths in tpg_alloc.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or later; exercise tpg_alloc error paths under memory pressure and verify no net memory growth via slabinfo or kmemleak.

Typical attack path

1. Obtain local code execution or access on a Linux system using the v4l2-tpg driver.
2. Trigger repeated calls to tpg_alloc that hit error paths inside allocation loops.
3. Observe gradual kernel memory consumption without corresponding frees.
4. Continue until system resources are exhausted or stability is impacted.

How to detect it

Inspect kernel logs for repeated tpg_alloc failures, monitor slab usage growth for v4l2-tpg related objects, and review any custom drivers or test tools invoking the affected allocation paths.

What your security team should do

• Prioritize kernel upgrades on systems exposing V4L2 video capture or testing interfaces.
• Monitor for availability issues on multimedia workloads until patches are applied.
• Review downstream distributions for backported fixes matching the referenced commit.