CVE-2026-23170: Linux Kernel drm/imx/tve Resource Leak

CVE-2026-23170 Overview

CVE-2026-23170 is a Memory Leak vulnerability in the Linux kernel affecting the DRM (Direct Rendering Manager) subsystem, specifically within the i.MX TV Encoder (TVE) driver. The vulnerability occurs when the driver fails to properly drop the reference taken to the DDC (Display Data Channel) device during probe operations, resulting in a device reference leak on probe failure scenarios such as probe deferral, as well as during driver unbind operations.

Critical Impact

This vulnerability can lead to kernel memory leaks and potential resource exhaustion on systems utilizing i.MX display hardware with TVE components.

Affected Products

• Linux Kernel (drm/imx/tve subsystem)
• Systems with i.MX SoC TV Encoder (TVE) hardware
• Embedded devices using i.MX display drivers

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23170 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23170

Vulnerability Analysis

The vulnerability resides in the drm/imx/tve driver's probe function within the Linux kernel. During the probe sequence, the driver acquires a reference to the DDC device for display data channel communication. However, the existing implementation fails to properly release this reference in error paths during probe failures (such as when probe deferral occurs) and also neglects to drop the reference during the driver unbind sequence.

This constitutes a classic reference counting bug where device objects are not properly managed through their lifecycle. When probe fails or is deferred, the DDC device reference count remains incremented without a corresponding decrement, preventing proper cleanup. Similarly, when the driver is unbound from a device, the held reference is not released, leading to accumulated memory leaks over time.

Root Cause

The root cause is improper resource management in the drm/imx/tve driver's probe and remove functions. The driver acquires a reference to the DDC device via device tree lookup during initialization but fails to implement proper cleanup paths that would call put_device() or equivalent reference release functions when:

1. The probe function encounters an error and needs to clean up before returning
2. Probe deferral occurs (-EPROBE_DEFER return)
3. The driver's remove function is called during unbind

This oversight results in orphaned device references that persist in kernel memory.

Attack Vector

The vulnerability has an unknown attack vector classification. In practical terms, exploitation would require:

1. Physical access or control over hardware that triggers repeated probe deferrals or driver load/unload cycles
2. The ability to cause the drm/imx/tve driver to be loaded and unloaded repeatedly

While direct remote exploitation is unlikely, the memory leak could be triggered through repeated driver binding/unbinding operations on affected embedded systems, potentially leading to memory exhaustion over extended periods of operation.

The vulnerability manifests during kernel driver operations when the DDC device reference is acquired but not properly released. The fix ensures that put_device() is called on the DDC device in all error paths within the probe function and during driver unbind. See the kernel commit patches for technical implementation details.

Detection Methods for CVE-2026-23170

Indicators of Compromise

• Gradual increase in kernel memory usage on systems with i.MX TVE hardware
• Elevated device reference counts visible in kernel debugging tools
• Memory allocation failures after extended system uptime on affected devices
• Kernel log messages related to drm/imx/tve probe failures or deferrals

Detection Strategies

• Monitor kernel memory statistics for unexplained growth patterns on embedded i.MX systems
• Enable kernel debugging options to track device reference counting anomalies
• Review dmesg output for repeated drm/imx/tve probe deferral messages
• Use kmemleak kernel tool to identify unreleased device structures

Monitoring Recommendations

• Implement memory utilization alerting on affected embedded systems
• Configure periodic kernel memory audits on i.MX-based devices
• Monitor for repeated driver bind/unbind events that could exacerbate the leak
• Track long-term memory trends on systems with display subsystem activity

How to Mitigate CVE-2026-23170

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix
• Review affected systems for signs of memory degradation
• Schedule maintenance windows for kernel updates on embedded i.MX systems
• Consider temporary workarounds to minimize driver reload operations

Patch Information

Multiple kernel patches have been released to address this vulnerability. The fix ensures proper reference management by calling put_device() on the DDC device in probe error paths and during driver unbind.

Available patches:

• Kernel Commit 4aaff8f
• Kernel Commit 52755c5
• Kernel Commit 7736538
• Kernel Commit 9a15d3f
• Kernel Commit ca68745
• Kernel Commit e535c23
• Kernel Commit f212652

Workarounds

• Minimize driver reload operations on affected systems until patches can be applied
• Schedule periodic system reboots to clear accumulated memory leaks on systems where patching is delayed
• Monitor system memory closely and implement automated recovery procedures if exhaustion is detected
• Consider disabling the drm/imx/tve module if TVE functionality is not required

# Check if the drm/imx/tve module is loaded
lsmod | grep imx_tve

# Monitor kernel memory usage
cat /proc/meminfo | grep -E "MemFree|MemAvailable|Slab"

# Check for driver bind/unbind events in kernel logs
dmesg | grep -i "imx-tve"