CVE-2026-45926 Overview
CVE-2026-45926 is a memory leak vulnerability in the Linux kernel's Rust Pulse Width Modulation (PWM) subsystem. The flaw resides in the chip initialization path that uses pwmchip_alloc(). The allocated device holds an initial reference that the driver must release on every error path. When __pinned_init() fails, the existing error path returns without calling pwmchip_put(), leaving the allocated pwm_chip structure unreleased.
The issue has been resolved upstream through two stable kernel commits. The vulnerability is constrained to kernels that include the Rust PWM abstractions and exercise the failing initialization path.
Critical Impact
Repeated failed PWM chip initialization can exhaust kernel memory, potentially leading to denial of service on systems running affected Rust-enabled Linux kernels.
Affected Products
- Linux kernel versions containing the Rust PWM abstractions
- Distributions shipping Rust-enabled Linux kernel builds
- Embedded and IoT platforms leveraging the kernel PWM subsystem through Rust drivers
Discovery Timeline
- 2026-05-27 - CVE-2026-45926 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45926
Vulnerability Analysis
The defect is a memory leak in the Rust PWM chip initialization sequence. The kernel allocates a pwm_chip instance via pwmchip_alloc(), which returns a structure that carries an initial reference count. Releasing this reference requires an explicit call to pwmchip_put().
The original Rust code follows the allocation with __pinned_init() to complete object construction. If __pinned_init() returns an error, control flow exits the initialization function without dropping the reference acquired during allocation. The pwm_chip and its associated kernel allocations remain resident until reboot.
The attack surface is limited. Triggering the leak requires conditions that cause __pinned_init() to fail, which typically depend on driver probe failures or constrained kernel resources. Each failed initialization compounds the leak.
Root Cause
The root cause is missing cleanup on an error return path, a class of bug tracked under improper resource release. The Rust abstraction did not mirror the C convention requiring pwmchip_put() on every failure branch following a successful pwmchip_alloc().
Attack Vector
The attack vector is local and indirect. An attacker with the ability to repeatedly trigger PWM driver probe failures, or a malfunctioning driver that retries initialization, can amplify the leak. There is no evidence of remote exploitation. No public exploit code is available, and the EPSS percentile remains low.
No verified proof-of-concept code is published. Technical details are available in the upstream stable tree commits referenced below.
Detection Methods for CVE-2026-45926
Indicators of Compromise
- Gradual reduction in available kernel memory (MemAvailable in /proc/meminfo) without a corresponding workload increase
- Repeated PWM driver probe failure messages in dmesg or the journal
- Growing Slab or SUnreclaim values in /proc/meminfo on systems exercising Rust PWM drivers
Detection Strategies
- Audit running kernels for the presence of the unpatched Rust PWM abstraction by checking kernel version against the fixed commits a2633dc243c3 and baa8b7097d9c
- Correlate PWM probe error logs with kernel slab growth using observability tooling
- Track repeated pwmchip_alloc allocation events through kmemleak when enabled in development or test builds
Monitoring Recommendations
- Enable CONFIG_DEBUG_KMEMLEAK in non-production kernels exercising Rust PWM drivers to surface leaked allocations
- Alert on sustained downward trends in available memory on long-running embedded devices
- Forward kernel logs to a centralized logging platform and create rules for PWM initialization failures
How to Mitigate CVE-2026-45926
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits a2633dc243c3 and baa8b7097d9c
- Update to a stable kernel release that incorporates the fix once available from your distribution
- Identify systems running Rust-enabled kernels with PWM drivers and prioritize patching where probe failures have been observed
Patch Information
The fix adds the missing pwmchip_put() call on the failure path of __pinned_init() so the initial reference is released when initialization fails. See Linux Kernel Commit a2633dc243c3 and Linux Kernel Commit baa8b7097d9c for the upstream changes.
Workarounds
- Disable or unload Rust PWM drivers on systems where they are not required
- Reboot affected systems to reclaim leaked memory until a patched kernel can be deployed
- Restrict local access on systems that repeatedly trigger PWM driver probe failures to reduce amplification risk
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
