CVE-2026-68221
NoneCVSS
—
EPSS
0.2%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A coding mistake in a specialized video driver can cause a system to slowly lose available memory each time the driver starts or stops, eventually affecting stability.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
The npcm_video_probe function allocates an npcm_video structure via kzalloc without freeing it on error paths, and npcm_video_remove omits the free entirely; additionally, failure in npcm_video_setup_video leaves the reserved-memory association created by of_reserved_mem_device_init unreleased, leaking an rmem_assigned_device list entry.
Why it matters to the business
Systems using the npcm-video driver may experience gradual kernel memory exhaustion when the driver is bound or unbound repeatedly, potentially leading to reduced availability or forced reboots in embedded or video-capture deployments.
How an attack unfolds
An attacker with local access could repeatedly load and unload the npcm-video kernel module (or trigger probe/remove paths) to accelerate the memory leak; no remote vector or privilege escalation is described.
How to fix it
Apply the upstream fix that adds kfree(video) to all probe error paths and to npcm_video_remove, plus the missing of_reserved_mem_device_release call on npcm_video_setup_video failure; rebuild and deploy the corrected kernel.
How to confirm the fix worked
Inspect the patched source for the added kfree and of_reserved_mem_device_release calls; run the driver through repeated probe/remove cycles under kmemleak or similar memory debugging tools to confirm absence of new leaks.
Typical attack path
- Obtain local access on a system with the npcm-video driver present
- Trigger repeated module insertion and removal or device bind/unbind operations
- Observe progressive consumption of kernel memory until system impact occurs
How to detect it
Review kernel logs for repeated npcm-video probe or remove messages; correlate with rising slab or vmalloc usage via /proc/meminfo or kmemleak reports over time.
What your security team should do
- Prioritize patching kernel packages containing the npcm-video driver in all affected embedded or video-capture deployments
- Monitor kernel memory usage trends on systems exposing this driver
- Restrict unprivileged module loading where feasible until the fix is applied
The record
In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcm_video_probe() allocates the npcm_video structure with kzalloc_obj() but never frees it on any probe error path or in npcm_video_remove(), leaking the allocation on every failed probe and every normal unbind. Additionally, when npcm_video_setup_video() fails, the reserved memory association established by of_reserved_mem_device_init() in npcm_video_init() is not released, leaking the rmem_assigned_device entry on the global list. Fix both by adding kfree(video) to all probe error paths and to npcm_video_remove(), and adding the missing of_reserved_mem_device_release() call when npcm_video_setup_video() fails.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|