CVE-2026-45881: Linux Kernel Memory Leak Vulnerability

CVE-2026-45881 Overview

CVE-2026-45881 is a memory leak vulnerability in the Linux kernel's MediaTek Smart Voltage Scaling (SVS) driver. The flaw resides in the svs_enable_debug_write() function within drivers/soc/mediatek/mtk-svs.c. When kstrtoint() fails to parse user-supplied input, the buffer allocated by memdup_user_nul() is not released, resulting in a kernel memory leak on each failed write to the debug interface.

The upstream fix replaces explicit kfree() calls with the __free(kfree) cleanup attribute, ensuring automatic release of the buffer on all return paths. The patch also adds the missing cleanup.h header inclusion.

Critical Impact
Repeated triggering of the failure path leaks kernel heap memory, gradually exhausting system resources on affected MediaTek SoC platforms.

Affected Products

Linux kernel versions containing the MediaTek SVS driver (drivers/soc/mediatek/mtk-svs.c)
Systems based on MediaTek SoCs that expose the SVS debugfs interface
Multiple stable kernel branches receiving the backported fix

Discovery Timeline

2026-05-27 - CVE-2026-45881 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45881

Vulnerability Analysis

The vulnerability is classified as a Memory Leak [CWE-401] in the MediaTek SVS subsystem of the Linux kernel. The svs_enable_debug_write() function handles writes to a debugfs entry used to toggle SVS debug behavior. It calls memdup_user_nul() to copy user-supplied bytes into a kernel buffer, then invokes kstrtoint() to convert that buffer into an integer value.

When kstrtoint() returns an error, the original implementation returns directly without freeing the buffer. Each failed write therefore leaks the allocated memory in kernel heap. A local user with write access to the debugfs node can repeatedly send invalid input to drain memory over time.

The fix annotates the buffer pointer with the __free(kfree) cleanup attribute introduced in modern Linux kernels. This guarantees the allocation is freed when the variable goes out of scope, regardless of the return path. The patch also adds #include <linux/cleanup.h> to make the macro available.

Root Cause

The root cause is a missing free on the error path in svs_enable_debug_write(). The function allocated a kernel buffer via memdup_user_nul() but only released it on the success path, omitting cleanup when kstrtoint() rejected malformed input.

Attack Vector

Exploitation requires local access and sufficient privileges to write to the SVS debugfs file, typically restricted to root. The impact is limited to resource exhaustion on MediaTek-based Linux systems rather than code execution or privilege escalation.

The vulnerability mechanism is described in prose only; no public proof-of-concept code is available. Refer to the upstream commits for the exact diff.

Detection Methods for CVE-2026-45881

Indicators of Compromise

Gradual unexplained growth in kernel slab memory allocations on MediaTek SoC systems
Repeated write syscalls targeting the SVS debugfs interface from non-system processes
dmesg entries reflecting failed integer parsing from the SVS debug write handler

Detection Strategies

Audit kernel package versions against the fixed builds referenced by the upstream stable commits (06195456, 0f649807, 47a3e372, 6259094e, 6bb10466, a58c9782).
Use kmemleak on development and test devices to confirm presence of leaks tied to the SVS write handler.
Monitor slab allocators such as kmalloc-* for sustained growth correlated with workloads that exercise SVS debugfs entries.

Monitoring Recommendations

Track /proc/meminfo and /proc/slabinfo trends on MediaTek devices to identify slow leaks.
Restrict and log access to /sys/kernel/debug/ paths exposed by the SVS driver.
Alert on processes opening SVS debug interfaces outside expected vendor diagnostic tooling.

How to Mitigate CVE-2026-45881

Immediate Actions Required

Update affected Linux kernels to a stable release that includes the fix referenced by the upstream commits.
Inventory MediaTek SoC-based Linux systems and prioritize embedded devices, where reboot cycles are infrequent and leaks accumulate.
Limit debugfs mount and access permissions so only privileged maintenance accounts can reach SVS interfaces.

Patch Information

The fix is committed in the upstream Linux kernel and backported to multiple stable branches. Apply the vendor kernel update that incorporates commits 06195456c4e4, 0f6498077faa, 47a3e372f7d6, 6259094ee806, 6bb10466e088, or a58c97828911, depending on the branch in use.

Workarounds

Unmount or restrict access to debugfs (mount -o remount,mode=0700 /sys/kernel/debug) where operationally acceptable.
Avoid writing untrusted or unparseable data to the SVS debug interface on production devices.
Schedule periodic reboots on long-running embedded systems until the patched kernel is deployed.

bash

# Configuration example: restrict debugfs to root only
mount -o remount,mode=0700,uid=0,gid=0 /sys/kernel/debug

# Verify running kernel version against patched stable releases
uname -r