CVE-2026-45928 Overview
CVE-2026-45928 is a memory leak vulnerability in the Linux kernel's chips-media wave5 Video Processing Unit (VPU) driver. The flaw resides in the wave5_vpu_open_enc() and wave5_vpu_open_dec() functions within the media subsystem. Both functions allocate a VPU instance using kzalloc(), then attempt a second allocation for inst->codec_info. When the codec_info allocation fails, the functions return -ENOMEM without releasing the previously allocated instance, leaking kernel memory on each failure path. The Linux kernel maintainers have resolved the issue by adding a kfree() call on the instance pointer in the error path.
Critical Impact
Repeated failures during VPU encoder or decoder initialization progressively exhaust kernel memory, degrading system stability on devices using the wave5 media driver.
Affected Products
- Linux kernel chips-media wave5 VPU driver (encoder path: wave5_vpu_open_enc())
- Linux kernel chips-media wave5 VPU driver (decoder path: wave5_vpu_open_dec())
- Stable kernel branches referenced in the upstream fix commits
Discovery Timeline
- 2026-05-27 - CVE-2026-45928 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45928
Vulnerability Analysis
The vulnerability is a classic memory leak [CWE-401] in a kernel device driver error path. The wave5_vpu_open_enc() and wave5_vpu_open_dec() functions implement the open handlers for the Chips&Media WAVE5 series VPU. Each handler allocates a fresh VPU instance structure with kzalloc() to track per-open state. The handler then performs a second kzalloc() for the codec_info member, which holds encoder or decoder specific configuration. If this second allocation returns NULL, the function bails out with -ENOMEM. The original instance pointer is never freed before returning, so the kernel slab allocation is orphaned.
Unprivileged userspace can trigger the open path by opening the VPU character device exposed by the V4L2 subsystem. Under memory pressure, repeated open attempts where codec_info allocation fails accumulate leaked instances in kernel memory.
Root Cause
The root cause is missing cleanup in an allocation failure path. The functions did not pair the initial kzalloc() for the instance with a corresponding kfree() when subsequent allocations failed. The upstream patches add the missing kfree(inst) before the return -ENOMEM to ensure the instance is released on every failure path.
Attack Vector
A local user with access to the wave5 VPU device node can repeatedly invoke the open syscall. When combined with induced memory pressure that causes the codec_info allocation to fail, each failed open leaks a small kernel allocation. Sustained exploitation amounts to a local denial-of-service through kernel memory exhaustion. No code execution or privilege escalation is associated with this flaw.
The vulnerability is described in prose because no proof-of-concept code has been published. Refer to the upstream fixes in the Kernel Git Commit Log #1, Kernel Git Commit Log #2, Kernel Git Commit Log #3, and Kernel Git Commit Log #4 for the exact source changes.
Detection Methods for CVE-2026-45928
Indicators of Compromise
- Growing kernel slab usage attributable to the kmalloc caches without a corresponding rise in active VPU sessions.
- Repeated -ENOMEM returns from open syscalls against the wave5 VPU device node, visible via strace or kernel ftrace.
- Gradual reduction in MemAvailable reported by /proc/meminfo on systems running the wave5 driver.
Detection Strategies
- Monitor /proc/slabinfo for unexplained growth in generic kmalloc slab caches on hosts using the chips-media wave5 driver.
- Audit kernel logs for high-frequency VPU open failures correlated with memory pressure events.
- Inspect kernel version and confirm whether the patched commits are present in the running build.
Monitoring Recommendations
- Track per-process VPU device handle counts and open syscall failure rates on media-processing workloads.
- Alert on sustained downward trends in available kernel memory on long-running embedded or media servers using wave5 hardware.
- Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) on test systems to validate the fix is applied.
How to Mitigate CVE-2026-45928
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the four git.kernel.org commits and rebuild affected kernels.
- Update to a stable kernel release that incorporates the wave5 codec_info allocation fix.
- Restrict access to the wave5 VPU device node so that only trusted media services can open it.
Patch Information
The fix adds a kfree(inst) call in the failure path of both wave5_vpu_open_enc() and wave5_vpu_open_dec() before the function returns -ENOMEM. Patched sources are available in the upstream commits: 1de71556, 32e9e45c, 52defdd4, and a519e21e. Distribution maintainers should backport these commits to supported stable branches.
Workarounds
- If the wave5 VPU is not required, blacklist or unload the wave5 kernel module to remove the vulnerable code path.
- Tighten Unix permissions and udev rules on the VPU character device to deny non-privileged users.
- Apply cgroup memory limits to services that interact with the wave5 driver to bound the impact of any leak.
# Verify whether the wave5 module is loaded and restrict access
lsmod | grep wave5
# Optionally prevent the module from loading at boot
echo 'blacklist wave5' | sudo tee /etc/modprobe.d/blacklist-wave5.conf
# Tighten permissions on the VPU device node via udev
echo 'KERNEL=="vpu*", MODE="0660", GROUP="video"' | \
sudo tee /etc/udev/rules.d/90-wave5-vpu.rules
sudo udevadm control --reload-rules && sudo udevadm trigger
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
