Cloudanix VulnDB

CVE-2026-68212

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a Linux video-capture driver can waste memory and cause crashes or instability when certain hardware is attached or initialized.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Unchecked return values from page table allocations in saa7134_video_init1 allow continued execution with invalid structures; subsequent queue initialization failures leak the allocated tables, and error paths during early probing bypass normal cleanup, leaving uninitialized DMA resources and memory leaks.

Why it matters to the business

Systems using the affected video capture hardware may experience resource exhaustion, instability during boot or device attachment, and potential crashes or unpredictable DMA behavior that disrupts media capture workloads.

How an attack unfolds

An attacker with local access or the ability to trigger device probe (via hardware insertion or module load) can cause the driver to retain invalid page tables and uninitialized DMA mappings, leading to memory corruption or denial of service when the driver later accesses those resources.

How to fix it

Apply the upstream fix that adds return-value checks for both saa7134_pgtable_alloc calls, frees page tables on any subsequent failure, and releases control handlers on error paths; rebuild and deploy the corrected kernel module or distribution package containing the resolution.

How to confirm the fix worked

Confirm the patched saa7134_video_init1 function contains explicit error checks and cleanup on all allocation and queue-init paths; recompile with the fix and verify that probe failures no longer leak memory via kmemleak or similar tools.

Typical attack path

  1. Trigger loading or probing of the saa7134 driver with the vulnerable video initialization path
  2. Force saa7134_pgtable_alloc calls to fail or cause vb2_queue_init to fail after partial allocation
  3. Bypass normal finidev cleanup because the device never fully registers
  4. Trigger later driver use of the leaked or uninitialized DMA resources to induce corruption or crash

How to detect it

Review kernel logs around device probe events for saa7134 initialization failures without corresponding cleanup; inspect for repeated allocation attempts that are not freed, or use memory-leak detectors on systems that have loaded the driver.

What your security team should do

  • Prioritize kernel updates containing the saa7134 fix on any system that may load the driver
  • Disable the saa7134 module if the hardware is not required
  • Monitor for kernel oops or memory-leak reports on systems exposing the device

The record

In the Linux kernel, the following vulnerability has been resolved: media: saa7134: Fix a possible memory leak in saa7134_video_init1 In saa7134_video_init1(), the return value of the first saa7134_pgtable_alloc() is not checked. If it fails, the function continues as if successful, leaving the driver with an invalid page table. Additionally, if vb2_queue_init() for the VBI queue fails after the video queue page table has been allocated, the allocated memory is not freed before returning. The second saa7134_pgtable_alloc() also lacks a return value check. Errors occur during device probing before the device is fully registered, the normal cleanup path in saa7134_finidev() is not executed, leading to memory leaks and potential use of uninitialized DMA resources. Check the return value of both saa7134_pgtable_alloc() calls and propagate errors. On failure of any later step, free allocated page tables to avoid memory leaks. Ensure control handlers are also released on error to prevent further resource leakage. Found by code review.

Affected packages

Ecosystem Package Introduced Fixed