CVE-2026-45939 Overview
CVE-2026-45939 is a memory leak vulnerability in the Linux kernel's gpib subsystem, specifically in the ni_usb_init() function of the National Instruments USB GPIB driver. When ni_usb_setup_init() fails, ni_usb_init() returns -EFAULT without releasing the previously allocated writes buffer. This results in kernel memory exhaustion under repeated failure conditions. The issue also includes an incorrect error propagation path where ni_usb_setup_init() returns 0 on failure, causing the caller to surface an inappropriate -EFAULT status. Maintainers resolved the defect by freeing the writes buffer in the error path and returning -EINVAL from ni_usb_setup_init().
Critical Impact
Repeated failures in ni_usb_init() leak kernel memory associated with the writes buffer, contributing to resource exhaustion on systems using the GPIB USB driver.
Affected Products
- Linux kernel versions containing the gpibni_usb driver prior to the fixing commits
- Distributions shipping the affected stable kernel branches
- Systems using National Instruments USB-GPIB hardware via the in-tree driver
Discovery Timeline
- 2026-05-27 - CVE-2026-45939 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45939
Vulnerability Analysis
The defect resides in the initialization path of the Linux kernel's gpib National Instruments USB driver. ni_usb_init() allocates a writes buffer before invoking ni_usb_setup_init() to complete device setup. If ni_usb_setup_init() fails, the caller returns immediately with -EFAULT and never frees the previously allocated buffer. Each failed initialization attempt therefore leaves an orphaned allocation in kernel memory.
A secondary defect compounds the issue. The helper ni_usb_setup_init() returns 0 on failure rather than a negative error code. The caller interprets this incorrectly and surfaces -EFAULT, an error code that does not describe the actual setup failure. This obscures diagnostics and complicates downstream error handling.
Root Cause
The root cause is improper error-path cleanup combined with inconsistent error-code semantics [CWE-401]. The allocation of writes is not paired with a corresponding kfree() in the failure branch. Additionally, ni_usb_setup_init() violates the kernel convention of returning negative errno values on failure.
Attack Vector
Triggering the leak requires conditions that cause ni_usb_setup_init() to fail during driver probing or device attachment. A local attacker with the ability to attach or detach a USB GPIB device, or to induce repeated initialization failures, can amplify the leak over time. The vulnerability does not provide a direct code execution primitive, but resource exhaustion can affect kernel stability.
The vulnerability mechanism is described in the upstream patches. See the Kernel Patch Commit (9c97fcfb), Kernel Patch Commit (b89921ee), and Kernel Patch Commit (c899d4b6) for the source-level changes.
Detection Methods for CVE-2026-45939
Indicators of Compromise
- Growth in unaccounted kernel slab allocations attributable to kmalloc callers in the gpib driver path
- Repeated ni_usb_init failure messages in dmesg accompanied by -EFAULT returns
- Increasing SUnreclaim values in /proc/meminfo on hosts exercising USB GPIB devices
Detection Strategies
- Audit installed kernel versions across Linux endpoints and compare against the fixing commit hashes 9c97fcfb, b89921ee, and c899d4b6
- Monitor kernel logs for repeated GPIB initialization failures, which indicate the leak-triggering code path is being exercised
- Track per-process and slab memory trends with slabtop and kmemleak on systems with CONFIG_DEBUG_KMEMLEAK enabled
Monitoring Recommendations
- Forward dmesg and journald kernel logs to a centralized log platform for correlation of GPIB driver errors
- Establish baselines for kernel slab memory consumption on systems using GPIB hardware
- Alert on USB device attach or detach events that correlate with kernel error messages from ni_usb
How to Mitigate CVE-2026-45939
Immediate Actions Required
- Apply the upstream stable kernel updates that contain commits 9c97fcfb, b89921ee, and c899d4b6
- Track distribution security advisories and deploy patched kernel packages once available
- Restrict physical and logical access to USB ports on systems running the affected driver to limit attack surface
Patch Information
Upstream maintainers resolved the issue by freeing the writes buffer in the error path of ni_usb_init() and by changing ni_usb_setup_init() to return -EINVAL on failure. The caller now propagates this error code correctly. Patches are available in the stable tree at the Kernel Patch Commit (9c97fcfb), Kernel Patch Commit (b89921ee), and Kernel Patch Commit (c899d4b6).
Workarounds
- Unload the ni_usb_gpib kernel module on systems that do not require GPIB functionality
- Blacklist the ni_usb_gpib module via /etc/modprobe.d/ to prevent automatic loading
- Disconnect National Instruments USB GPIB devices until patched kernels are deployed
# Configuration example: prevent the vulnerable driver from loading
echo "blacklist ni_usb_gpib" | sudo tee /etc/modprobe.d/disable-ni-usb-gpib.conf
sudo rmmod ni_usb_gpib 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
