CVE-2026-68221
Received Received - Intake

Memory Leak in Nuvoton NPCM Video Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcm_video_probe() allocates the npcm_video structure with kzalloc_obj() but never frees it on any probe error path or in npcm_video_remove(), leaking the allocation on every failed probe and every normal unbind. Additionally, when npcm_video_setup_video() fails, the reserved memory association established by of_reserved_mem_device_init() in npcm_video_init() is not released, leaking the rmem_assigned_device entry on the global list. Fix both by adding kfree(video) to all probe error paths and to npcm_video_remove(), and adding the missing of_reserved_mem_device_release() call when npcm_video_setup_video() fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68221
EUVD
EUVD-2026-55322

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nuvoton npcm_video *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves memory leaks in the Nuvoton NPCM video driver. During probe operations, memory allocated for the npcm_video structure is not freed if errors occur or during normal removal, causing leaks. Additionally, reserved memory associations are not released when video setup fails, further leaking system resources.

Detection Guidance

This vulnerability is specific to the Linux kernel's nuvoton npcm-video driver and involves memory leaks during probe and remove operations. Detection requires checking kernel logs for probe failures or memory leaks related to npcm_video. Use commands like dmesg | grep npcm_video or journalctl -k | grep npcm_video to inspect kernel logs for errors or warnings.

Impact Analysis

This vulnerability can lead to gradual depletion of system memory, causing performance degradation or crashes. It may also result in resource exhaustion if devices are frequently probed or removed, potentially disrupting normal system operations.

Mitigation Strategies

Apply the kernel patch that fixes the memory leaks in the npcm_video driver. Update to a kernel version that includes the fix. If immediate patching is not possible, disable the npcm_video driver module if not in use to prevent potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68221. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart