CVE-2026-45954: Linux Kernel Memory Leak Vulnerability

CVE-2026-45954 Overview

CVE-2026-45954 is a memory leak vulnerability in the Linux kernel framebuffer driver au1200fb. The flaw resides in the au1200fb_drv_probe() function within the fbdev subsystem. When the call to platform_get_irq() fails, the function returns an error code directly without releasing previously allocated resources. This direct-return path bypasses the driver's cleanup logic, causing kernel memory to leak on each failed probe. The Linux kernel maintainers resolved the issue by replacing the direct return with a goto label that routes execution through proper resource cleanup.

Critical Impact
Repeated probe failures in the au1200fb framebuffer driver leak kernel memory, contributing to resource exhaustion and degraded system stability on affected Linux systems.

Affected Products

Linux kernel versions containing the au1200fb fbdev driver prior to the fix commits
Systems built with CONFIG_FB_AU1200 enabled (Alchemy Au1200 SoC platforms)
Downstream Linux distributions shipping the unpatched fbdev subsystem

Discovery Timeline

2026-05-27 - CVE-2026-45954 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45954

Vulnerability Analysis

The vulnerability sits in the probe routine of the au1200fb framebuffer driver, located in drivers/video/fbdev/au1200fb.c. The probe function allocates several resources during device initialization before requesting the platform interrupt line. When platform_get_irq() returns an error, the original code path executes a direct return with the error code. This abandons the previously allocated memory and other initialized state without invoking the driver's standard cleanup sequence. Each failure leaks kernel memory that the allocator can no longer reclaim until reboot.

The upstream fix replaces the direct return with a goto to an existing error-handling label. That label unwinds allocations in reverse order, restoring the driver's expected cleanup contract. The pattern is a classic Linux kernel memory leak [CWE-401] caused by an incomplete error path.

Root Cause

The root cause is improper error handling in au1200fb_drv_probe(). The function reaches a failure condition after performing successful resource allocations but exits without releasing them. Linux kernel coding conventions require probe functions to use centralized cleanup via goto labels to guarantee balanced allocation and release on every error path.

Attack Vector

The vulnerability requires conditions that trigger probe failure on hardware exposing the au1200fb driver. An attacker with local privileges to bind and unbind the driver, or to induce repeated probe failures, could amplify the leak. Remote exploitation is not applicable because the driver targets a specific embedded SoC framebuffer. The vulnerability primarily affects availability through resource exhaustion rather than confidentiality or integrity.

The vulnerability manifests in the probe-time error handling path. See the upstream kernel commits referenced below for the exact diff that introduces the goto cleanup label.

Detection Methods for CVE-2026-45954

Indicators of Compromise

Growing kmalloc slab consumption reported by /proc/slabinfo correlated with au1200fb probe attempts
Repeated kernel log entries from au1200fb reporting platform_get_irq failures
Steadily declining MemFree in /proc/meminfo on systems that frequently rebind the driver

Detection Strategies

Audit kernel build configurations to identify hosts with CONFIG_FB_AU1200=y or =m and verify patch level against the upstream fix commits
Use kmemleak during testing to surface unreleased allocations originating from au1200fb_drv_probe()
Correlate dmesg output for probe failures with memory pressure events through centralized log aggregation

Monitoring Recommendations

Track long-term kernel memory utilization on embedded Linux fleets that use Alchemy Au1200 hardware
Alert on repeated driver bind or unbind cycles, which can amplify the leak under operational misconfiguration
Forward kernel logs to a SIEM or data lake for retroactive search against the affected driver name

How to Mitigate CVE-2026-45954

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable tree commits listed in this advisory
Rebuild and redeploy custom kernels that enable CONFIG_FB_AU1200 against a patched source tree
Restrict local privileges that allow unprivileged users to trigger driver bind, unbind, or module reload operations

Patch Information

The Linux kernel maintainers committed fixes across multiple stable branches. Apply the patch corresponding to your kernel branch:

Workarounds

Disable the au1200fb driver on systems that do not require Au1200 framebuffer support by unsetting CONFIG_FB_AU1200 and rebuilding the kernel
Blacklist the module on systems that load it dynamically to prevent probe attempts that could leak memory
Reboot affected systems periodically if patching is delayed to reclaim leaked kernel memory

bash

# Configuration example: disable the au1200fb module via modprobe blacklist
echo "blacklist au1200fb" | sudo tee /etc/modprobe.d/blacklist-au1200fb.conf
sudo update-initramfs -u