CVE-2026-43231
Memory Leak in Linux Kernel radio-keene Driver
Publication date: 2026-05-06
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.2 (inc) to 6.6.128 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.75 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.16 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.6 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.202 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.165 (exc) |
| linux | linux_kernel | From 3.4 (inc) to 5.10.252 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's media subsystem, specifically in the radio-keene driver. When the usb_keene_probe() function initializes the v4l2 control handler and adds controls, if subsequent calls to v4l2_device_register() or video_register_device() fail, the control handler is not freed properly. This causes a memory leak because the allocated resources are not released in the error path.
The fix involves adding a call to v4l2_ctrl_handler_free() in the error handling path to ensure that the control handler is freed properly whenever an error occurs after initialization.
How can this vulnerability impact me? :
This vulnerability can lead to a memory leak in the Linux kernel when using the affected media driver. Over time, repeated failures in device registration could cause the system to consume more memory than necessary, potentially leading to degraded system performance or instability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability described is a memory leak in the Linux kernel's media radio-keene component. It involves improper freeing of resources in error paths during device registration. There is no information provided about any impact on data confidentiality, integrity, or availability that would relate to compliance with standards such as GDPR or HIPAA.
Therefore, based on the provided information, there is no indication that this vulnerability directly affects compliance with common standards and regulations like GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is a memory leak in the Linux kernel's media radio-keene driver related to error handling in usb_keene_probe().
To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix where v4l2_ctrl_handler_free() is properly called in the error path to free the control handler.