CVE-2026-43218: Linux Kernel Memory Leak Vulnerability

CVE-2026-43218 Overview

CVE-2026-43218 is a memory leak vulnerability in the Linux kernel's tw9903 media i2c driver. The flaw resides in the tw9903_probe() function, where one of the error paths fails to release memory allocated by v4l2_ctrl_handler_init() and v4l2_ctrl_new_std(). When the probe routine encounters that specific error condition, it returns without invoking v4l2_ctrl_handler_free(), leaving the V4L2 control handler resources allocated. The upstream fix adds the missing free call to ensure resources are reclaimed when probing fails.

Critical Impact
Repeated probe failures of the tw9903 driver leak kernel memory associated with V4L2 controls, which can degrade system stability over time on affected Linux kernels.

Affected Products

Linux kernel media subsystem — drivers/media/i2c/tw9903 driver
Stable kernel branches receiving the backports referenced in the upstream commits
Systems using the Techwell TW9903 video decoder via the i2c media driver

Discovery Timeline

2026-05-06 - CVE-2026-43218 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43218

Vulnerability Analysis

The vulnerability is a kernel memory leak in the tw9903_probe() initialization routine of the V4L2 i2c sub-device driver for the Techwell TW9903 video decoder. During probe, the driver initializes a v4l2_ctrl_handler via v4l2_ctrl_handler_init() and registers standard controls via v4l2_ctrl_new_std(). Both calls allocate kernel memory tied to the handler.

If a subsequent step in tw9903_probe() returns an error, the original code branches to a return path that does not call v4l2_ctrl_handler_free(). The handler and its registered control structures remain allocated even though the device instance is being torn down. Each failed probe attempt produces another set of leaked allocations.

The vulnerability is local in nature and tied to driver initialization. Exploitation as a security primitive is constrained because triggering the leak requires the driver to load against matching hardware or a probe-induced failure path. The practical impact is resource exhaustion in long-running systems that repeatedly bind and fail to fully initialize the driver.

Root Cause

The root cause is missing cleanup on an error path [CWE-401: Missing Release of Memory after Effective Lifetime]. The probe function does not pair the successful allocation in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() with a corresponding v4l2_ctrl_handler_free() call when a later step fails.

Attack Vector

An attacker requires local access and the ability to trigger the affected driver's probe path. There is no remote attack surface. The fix described in the upstream patch adds the missing v4l2_ctrl_handler_free() invocation on the failing error path so that resources allocated earlier in tw9903_probe() are released. Refer to the Kernel.org Commit 32f04935 for the canonical patch.

Detection Methods for CVE-2026-43218

Indicators of Compromise

Growing kmalloc slab consumption attributable to V4L2 control handler allocations on hosts using the tw9903 driver.
Repeated kernel log entries indicating tw9903_probe() failures without matching cleanup messages.
Increasing unreclaimable kernel memory observed in /proc/meminfo over time on systems with the affected driver loaded.

Detection Strategies

Run the kernel with CONFIG_DEBUG_KMEMLEAK=y and inspect /sys/kernel/debug/kmemleak for unreferenced allocations originating in v4l2_ctrl_handler_init or v4l2_ctrl_new_std.
Compare the running kernel version against the fixed commits listed in the upstream references to confirm whether the patch is present.
Audit dmesg for repeated tw9903 probe error messages that correlate with memory growth.

Monitoring Recommendations

Track slab and Slab/SUnreclaim values in /proc/meminfo on Linux hosts using TV capture or video decoder hardware.
Alert on kernel module load events for tw9903 paired with probe failure return codes.
Periodically validate kernel package versions against distribution security advisories that incorporate the upstream fix.

How to Mitigate CVE-2026-43218

Immediate Actions Required

Update affected Linux kernels to a stable release that includes the fix from the referenced commits, such as Kernel.org Commit 32f04935 or Kernel.org Commit e54aa17c.
Inventory systems running the tw9903 i2c media driver and prioritize patching long-running hosts where leak accumulation is most impactful.
Validate that distribution kernel packages incorporate the upstream stable backport before deploying to production.

Patch Information

The upstream Linux kernel maintainers resolved this issue by calling v4l2_ctrl_handler_free() on the handler in the failing error path of tw9903_probe(). The fix has been backported to multiple stable branches. See the upstream references including Kernel.org Commit 92537a15, Kernel.org Commit 9cb9eca3, Kernel.org Commit 9cea16fe, Kernel.org Commit a1149182, Kernel.org Commit add02a3f, and Kernel.org Commit cc7aeed3.

Workarounds

Blacklist the tw9903 kernel module on systems that do not require the Techwell TW9903 video decoder until the patched kernel is deployed.
Reboot affected hosts periodically to reclaim leaked memory if patching cannot be performed immediately.
Restrict local access on shared hosts to limit who can trigger driver bind and probe operations.

bash

# Configuration example: prevent the affected driver from loading until patched
echo "blacklist tw9903" | sudo tee /etc/modprobe.d/blacklist-tw9903.conf
sudo update-initramfs -u