CVE-2026-43162: Linux Kernel Memory Leak Vulnerability

CVE-2026-43162 Overview

CVE-2026-43162 is a memory leak vulnerability in the Linux kernel's tegra-video media driver. The flaw resides in the __tegra_channel_try_format() function, where a state object allocated by __v4l2_subdev_state_alloc() is not released along error paths. When v4l2_subdev_call() fails, the function returns directly without calling __v4l2_subdev_state_free(), leaking the previously allocated sd_state object. Repeated invocations along these failure paths gradually exhaust kernel memory on affected NVIDIA Tegra-based systems.

Critical Impact
Repeated triggering of the failing code path in the Tegra Video4Linux2 (V4L2) driver leaks kernel memory, which can degrade system stability over time.

Affected Products

Linux kernel versions containing the tegra-video driver with the unfixed __tegra_channel_try_format() implementation
NVIDIA Tegra platforms using the Video4Linux2 (V4L2) media subsystem
Distributions shipping kernels prior to the fixes referenced in the upstream stable commits

Discovery Timeline

2026-05-06 - CVE-2026-43162 published to the National Vulnerability Database (NVD)
2026-05-06 - Last updated in the NVD database

Technical Details for CVE-2026-43162

Vulnerability Analysis

The vulnerability is a kernel-space memory leak in the Tegra video capture driver located under drivers/media/platform/nvidia/tegra-video/. The function __tegra_channel_try_format() allocates a subdevice state structure using __v4l2_subdev_state_alloc() to query and validate format capabilities. The Video4Linux2 (V4L2) subsystem requires that any state allocated via __v4l2_subdev_state_alloc() be paired with a matching __v4l2_subdev_state_free() call once it is no longer needed.

In the affected code, two error paths after v4l2_subdev_call() returned directly to the caller without freeing sd_state. Each failed invocation therefore orphans the allocation in kernel memory. Userspace processes interacting with the camera or capture device through standard VIDIOC_TRY_FMT ioctls can repeatedly trigger this path, slowly draining kernel slab memory.

Root Cause

The root cause is missing cleanup logic on error paths, classified as a memory leak [CWE-401]. The original implementation used early return statements when v4l2_subdev_call() reported failure, bypassing the required __v4l2_subdev_state_free() call. The upstream fix introduces a cleanup label and converts the error returns into goto statements, ensuring the allocated state is always released before the function exits.

Attack Vector

Exploitation requires local access to a Tegra-based system that exposes the tegra-video device nodes (typically /dev/video*) to a user with permission to issue V4L2 ioctls. An attacker capable of repeatedly invoking format negotiation operations that trigger the failing v4l2_subdev_call() branch can incrementally consume kernel memory. The flaw does not provide code execution or privilege escalation, but sustained exploitation may produce denial-of-service conditions on memory-constrained embedded devices.

No public exploit code is available, and no proof-of-concept has been published. The vulnerability is corrected in the kernel commits referenced in the Kernel Git Commit 2dff896, Kernel Git Commit 3ca2f09, Kernel Git Commit 43e5302, Kernel Git Commit 6c6f419, Kernel Git Commit ca921be, and Kernel Git Commit d92e9a1.

Detection Methods for CVE-2026-43162

Indicators of Compromise

Steadily growing kernel slab usage attributable to V4L2 subdevice state allocations on Tegra hardware
Unexplained kmalloc growth visible in /proc/slabinfo or slabtop output during periods of camera or capture activity
Out-of-memory (OOM) events on long-running Tegra systems performing repeated V4L2 format negotiation

Detection Strategies

Monitor kernel memory consumption trends on Tegra-based endpoints and correlate spikes with tegra-video driver usage
Audit running kernel versions against the upstream stable commits listed in the references to confirm the fix is applied
Use kmemleak (when enabled) to identify unreferenced allocations originating from __v4l2_subdev_state_alloc()

Monitoring Recommendations

Track process invocations of VIDIOC_TRY_FMT and related V4L2 ioctls on /dev/video* device nodes
Alert on sustained kernel memory growth without a corresponding rise in user workloads
Centralize kernel logs and syslog data to detect repeated failures from the tegra-video driver path

How to Mitigate CVE-2026-43162

Immediate Actions Required

Apply the upstream Linux kernel patch series referenced in the stable commits to remediate the memory leak
Inventory all NVIDIA Tegra-based devices and identify those running unpatched kernels
Restrict access to /dev/video* device nodes to trusted users and processes only

Patch Information

The fix introduces a cleanup label in __tegra_channel_try_format() and routes error paths through goto so that __v4l2_subdev_state_free() is always invoked before the function returns. Distribution maintainers have backported the fix into stable kernel branches via the commits 2dff896, 3ca2f09, 43e5302, 6c6f419, ca921be, and d92e9a1. Update to a kernel build that includes one of these commits for your branch.

Workarounds

Limit untrusted local access to systems exposing the tegra-video driver until the kernel update can be deployed
Apply Linux capability and access control restrictions on V4L2 device nodes to prevent unprivileged users from issuing format ioctls
Reboot affected Tegra systems on a scheduled basis to reclaim leaked kernel memory as a temporary measure until patching is complete

bash

# Verify the running kernel version on a Tegra device
uname -r

# Inspect V4L2 device node permissions
ls -l /dev/video*

# Restrict access to the video group only
sudo chown root:video /dev/video*
sudo chmod 0660 /dev/video*