CVE-2026-43246 Overview
CVE-2026-43246 is a memory leak vulnerability in the Linux kernel's media/i2c/tw9906 driver. The flaw resides in the tw9906_probe() function, where one of the error paths fails to release memory allocated by v4l2_ctrl_handler_init() and v4l2_ctrl_new_std(). When probe fails along this path, the V4L2 control handler is not freed, leading to resource leakage in kernel memory.
The issue affects systems using the Techwell TW9906 video decoder via the Video4Linux2 (V4L2) subsystem. The fix calls v4l2_ctrl_handler_free() on the handler in the affected error path.
Critical Impact
Repeated probe failures on the affected i2c driver can exhaust kernel memory, contributing to system instability or denial-of-service conditions over time.
Affected Products
- Linux kernel versions containing the media/i2c/tw9906 driver prior to the patch
- Systems integrating Techwell TW9906 video decoder hardware via V4L2
- Embedded and media capture platforms relying on the affected i2c driver path
Discovery Timeline
- 2026-05-06 - CVE-2026-43246 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43246
Vulnerability Analysis
The vulnerability is a kernel memory leak [CWE-401] in the Linux media subsystem driver tw9906. During device probe, the driver initializes a V4L2 control handler with v4l2_ctrl_handler_init() and registers standard controls through v4l2_ctrl_new_std(). Both functions allocate kernel memory tied to the handler.
If an error occurs after these allocations along a specific failure path in tw9906_probe(), the function returns without invoking v4l2_ctrl_handler_free(). The allocated control handler memory remains referenced only by the now-discarded device context, leaking on every failed probe.
The upstream patch resolves the leak by adding the missing v4l2_ctrl_handler_free() call in the offending error path, ensuring deterministic cleanup of V4L2 control resources.
Root Cause
The root cause is incomplete error-path cleanup in the driver's probe routine. The function allocates V4L2 control resources but exits one error branch without releasing them, violating the symmetric allocate-and-free contract expected of probe handlers in the Linux device model.
Attack Vector
The attack vector is local and requires the affected hardware path to be exercised. An attacker or fault condition that triggers repeated probe failures of the tw9906 driver can cause cumulative kernel memory consumption. Without local privileges or hardware control to induce probe failure, remote exploitation is not feasible. See the upstream commits referenced in the kernel.org stable tree for technical details of the corrected code path.
Detection Methods for CVE-2026-43246
Indicators of Compromise
- Gradual increase in kernel slab memory usage observable via /proc/slabinfo, particularly entries associated with V4L2 control allocations.
- Repeated tw9906_probe() failure messages in dmesg or the system journal coinciding with media device initialization.
- Unaccounted growth in unreclaimable kernel memory on systems that hot-plug or re-initialize affected i2c media hardware.
Detection Strategies
- Audit running kernel versions against the patched commits listed at kernel.org stable to identify unpatched hosts.
- Monitor kernel logs for repeated probe errors from the tw9906 or V4L2 subsystem during device initialization sequences.
- Track kmemleak reports on debug kernels to confirm leaks originating from v4l2_ctrl_handler_init allocation sites.
Monitoring Recommendations
- Establish baselines for kernel slab and Slab/SUnreclaim values from /proc/meminfo on systems with media capture workloads.
- Alert on sustained memory growth without a corresponding workload increase, particularly on long-uptime embedded devices.
- Correlate media subsystem error events with memory metrics in centralized logging to identify probe-failure-induced leaks early.
How to Mitigate CVE-2026-43246
Immediate Actions Required
- Identify all hosts running Linux kernels that include the unpatched media/i2c/tw9906 driver and prioritize those exposing media capture functionality.
- Apply the upstream stable kernel update containing the v4l2_ctrl_handler_free() cleanup fix.
- Reboot affected systems after patching to ensure the corrected driver is loaded.
Patch Information
The fix is available across multiple stable branches via the Linux kernel stable tree. Reference patches include Kernel Commit 0c33338, Kernel Commit 377a775, Kernel Commit 59420d5, Kernel Commit 9548a8b, Kernel Commit cad237b, Kernel Commit ccb92de, Kernel Commit e9a4909, and Kernel Commit fb09d8b. Apply the version corresponding to your stable branch.
Workarounds
- Blacklist the tw9906 kernel module on systems that do not require Techwell TW9906 hardware support to prevent the vulnerable probe path from executing.
- Restrict physical and administrative access that could repeatedly trigger probe failures on affected media hardware.
- Schedule controlled reboots on long-running systems exhibiting kernel memory growth until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
