CVE-2026-68203

Received Received - Intake

Memory Leak in Linux Kernel Vivid Driver

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vivid_init() When platform_device_register() fails in vivid_init(), the embedded struct device in vivid_pdev has already been initialized by device_initialize(), but the failure path jumps to free_output_strings without dropping the device reference for the current platform device: vivid_init() -> platform_device_register(&vivid_pdev) -> device_initialize(&vivid_pdev.dev) -> setup_pdev_dma_masks(&vivid_pdev) -> platform_device_add(&vivid_pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before jumping to the common cleanup path. Also, the unreg_driver label incorrectly calls platform_driver_register() instead of platform_driver_unregister(), which breaks cleanup when workqueue creation fails after successful driver registration. Fix that as well. The reference leak was identified by a static analysis tool I developed and confirmed by manual review. The incorrect cleanup call was found during code inspection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68203

EUVD

EUVD-2026-55304

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's media subsystem, specifically in the vivid driver initialization. When the vivid_init() function fails during platform device registration, it leaves a reference leak because the cleanup path does not properly release the device reference initialized by device_initialize(). Additionally, an incorrect cleanup call in the unreg_driver label uses platform_driver_register() instead of platform_driver_unregister(), causing cleanup failures when workqueue creation fails after driver registration.

Detection Guidance

This vulnerability is specific to the Linux kernel's vivid media driver and does not have network-based detection methods. To detect it, check if your kernel version includes the vulnerable code path by examining the vivid driver initialization. Use commands like 'modinfo vivid' or 'dmesg | grep vivid' to inspect driver status and logs.

Impact Analysis

This vulnerability primarily affects systems running the Linux kernel with the vivid media driver. It can lead to resource leaks during driver initialization failures, potentially causing memory or device reference leaks. While not directly exploitable for arbitrary code execution, it may cause system instability or resource exhaustion in affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a reference leak and cleanup bug in the Linux kernel's media subsystem. It may indirectly impact compliance if the affected system is used in environments requiring strict resource management or auditability.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for CVE-2026-68203. If you cannot update immediately, disable the vivid driver by blacklisting it using 'echo "blacklist vivid" >> /etc/modprobe.d/blacklist.conf' and reboot.

Hi! I’m here to help you understand CVE-2026-68203. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70