CVE-2026-43231: Linux Kernel Memory Leak Vulnerability

CVE-2026-43231 Overview

CVE-2026-43231 is a memory leak vulnerability in the Linux kernel radio-keene media driver. The flaw resides in the usb_keene_probe() function, which initializes a v4l2 control handler and registers controls before calling v4l2_device_register() and video_register_device(). When either registration call fails, the previously initialized control handler is not freed, leaving allocated memory orphaned. Repeated probe failures, such as those triggered by malformed USB device events or driver registration errors, accumulate leaked memory in the kernel slab allocator. The fix adds a v4l2_ctrl_handler_free() call in the err_v4l2 error path so all post-initialization failure paths properly release the handler.

Critical Impact
Repeated probe failures of the Keene FM radio USB driver leak kernel memory, contributing to long-running system resource exhaustion.

Affected Products

Linux kernel — radio-keene media driver
Multiple stable kernel branches (see referenced patches for affected ranges)
Distributions shipping the affected drivers/media/radio/radio-keene.c source

Discovery Timeline

2026-05-06 - CVE CVE-2026-43231 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43231

Vulnerability Analysis

The vulnerability is a kernel memory leak in the USB probe routine of the Keene FM transmitter radio driver. During device initialization, usb_keene_probe() calls v4l2_ctrl_handler_init() and adds new controls through v4l2_ctrl_new_std(). These calls allocate memory tracked by the control handler structure. The probe routine then proceeds to register the v4l2 device and the video device. If either registration fails, control jumps to the err_v4l2 label without releasing the handler resources. Each failed probe attempt leaves the previously allocated control handler memory unreferenced. Over time, repeated USB hot-plug cycles or driver load failures cause measurable kernel memory consumption.

Root Cause

The root cause is missing cleanup in an error-handling label. The err_v4l2 path in usb_keene_probe() was written before the control handler initialization was added, and was not updated to free the handler. Because v4l2_ctrl_handler_free() was not invoked, the kmalloc-backed control list and associated structures persisted past the failed probe. This pattern matches [CWE-401: Missing Release of Memory after Effective Lifetime].

Attack Vector

The attack vector is local and requires the ability to trigger driver probe failures. A user with physical access can repeatedly attach a Keene-compatible USB device under conditions that force v4l2_device_register() or video_register_device() to fail, such as resource pressure or namespace constraints. The defect does not yield code execution or privilege escalation. Its impact is constrained to gradual kernel memory exhaustion that can degrade system stability on long-running hosts. No public exploit is associated with this CVE.

The vulnerability mechanism is documented in the upstream patch series; see the Kernel Patch 1d8558a and Kernel Patch 242b0aa commits for the exact diff applied across stable trees.

Detection Methods for CVE-2026-43231

Indicators of Compromise

Growth of kernel slab caches such as kmalloc-* correlated with repeated USB probe failures for vendor/product matching the Keene FM transmitter.
Recurring dmesg entries from the radio-keene driver indicating v4l2_device_register or video_register_device failures.
Steady, unexplained increase in Slab and SUnreclaim values reported in /proc/meminfo on systems handling the affected USB device.

Detection Strategies

Audit installed kernel package versions against the fixed commits referenced in the Kernel.org stable tree to identify unpatched hosts.
Enable kmemleak on test systems to confirm leaked allocations originating from v4l2_ctrl_handler_init call paths.
Monitor USB hot-plug telemetry for repeated probe-failure cycles tied to the Keene vendor/product identifiers.

Monitoring Recommendations

Track kernel memory metrics over time and alert on sustained slab growth without corresponding workload changes.
Centralize dmesg and journald kernel logs to correlate driver probe errors with memory pressure events.
Inventory hosts that load the radio-keene module and prioritize patch deployment on those systems.

How to Mitigate CVE-2026-43231

Immediate Actions Required

Apply the upstream Linux kernel patches that add v4l2_ctrl_handler_free() to the err_v4l2 error path in usb_keene_probe().
Update to a distribution kernel package that incorporates the fix referenced by the stable tree commits.
On systems that do not require FM radio USB support, blacklist the radio-keene module to eliminate exposure.

Patch Information

The fix is published across multiple stable branches. Relevant commits include Kernel Patch 1d8558a, Kernel Patch 242b0aa, Kernel Patch 27c508f, Kernel Patch 2fe28a6, Kernel Patch 7fa9754, Kernel Patch ad85bb5, Kernel Patch b8bf939, and Kernel Patch de204d8. Each commit adds the missing v4l2_ctrl_handler_free() call so the control handler is released for every error path after initialization.

Workarounds

Unload and blacklist the radio-keene module on hosts that do not need FM radio USB hardware support.
Restrict physical USB access on servers and kiosks to prevent repeated probe-failure cycles from untrusted devices.
Schedule reboots on long-running hosts where the module has been loaded and probe failures have been observed, until patches are applied.

bash

# Configuration example
# Prevent the radio-keene driver from loading
echo 'blacklist radio-keene' | sudo tee /etc/modprobe.d/blacklist-radio-keene.conf
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep radio_keene

# Confirm running kernel version contains the fix
uname -r