Cloudanix VulnDB

CVE-2026-68215

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a Linux radio driver could leave system resources allocated after an error, slowly using up memory on affected machines.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Missing v4l2_device_unregister call on error path after v4l2_device_register in si476x_radio_probe leaves a device reference held when later allocation or registration steps fail.

Why it matters to the business

Repeated failed driver probes can accumulate unreleased references, gradually increasing memory pressure and potentially preventing clean module removal or device hot-unplug on affected Linux systems.

How an attack unfolds

An attacker with local access triggers repeated probe failures for the radio-si476x device through misconfiguration or hardware faults, causing the kernel to leak references each time without ever calling the remove path.

How to fix it

Update to a Linux kernel containing the referenced fix that adds v4l2_device_unregister on the probe error path after control handler cleanup.

How to confirm the fix worked

Inspect kernel source or running system for the corrected probe error handling that unconditionally unregisters the v4l2 device; review dmesg for successful probe completion after driver load.

Typical attack path

  1. Gain local access to a system with the si476x radio driver enabled
  2. Cause probe to fail after v4l2_device_register but before successful video device registration
  3. Repeat the failure condition to accumulate unreleased references
  4. Observe gradual resource exhaustion or failed module unload attempts

How to detect it

Search kernel logs and dmesg for si476x_radio_probe error paths that mention v4l2 device registration without a matching unregister; correlate with module load attempts.

What your security team should do

  • Apply the upstream kernel patch or distribution update that resolves the probe error path
  • Monitor kernel logs for repeated si476x probe failures indicating potential reference accumulation
  • Test driver load/unload cycles on systems using the si476x radio hardware

The record

In the Linux kernel, the following vulnerability has been resolved: media: radio-si476x: Unregister v4l2_device on probe failure si476x_radio_probe() registers radio->v4l2dev before allocating the V4L2 controls and before registering the video device. If any of those later steps fails, probe returns through the exit label after freeing only the control handler. A failed probe does not call si476x_radio_remove(), so the v4l2_device_unregister() there is not reached. This leaves the parent device reference taken by v4l2_device_register() behind on the error path. Unregister the V4L2 device in the probe error path after freeing the controls.

Affected packages

Ecosystem Package Introduced Fixed