CVE-2026-68215: Linux Kernel Privilege Escalation Flaw

CVE-2026-68215 Overview

CVE-2026-68215 is a resource leak vulnerability in the Linux kernel's radio-si476x media driver. The flaw exists in si476x_radio_probe(), which registers radio->v4l2dev before allocating V4L2 controls and registering the video device. When any subsequent step fails, the probe function exits without calling v4l2_device_unregister(), leaving the parent device reference held by v4l2_device_register() uncleaned. The upstream fix moves the unregister call into the probe error path after freeing the controls.

Critical Impact
A failed probe of the Silicon Labs Si476x radio driver leaks a v4l2_device registration and its parent device reference, contributing to reference count imbalance and resource exhaustion on affected Linux kernels.

Affected Products

Linux kernel media subsystem (drivers/media/radio/radio-si476x.c)
Kernel builds with CONFIG_RADIO_SI476X enabled
Multiple stable kernel branches referenced by upstream fix commits

Discovery Timeline

2026-08-10 - CVE-2026-68215 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68215

Vulnerability Analysis

The vulnerability resides in the probe function of the Silicon Labs Si476x FM radio driver in the Linux kernel media subsystem. During device initialization, si476x_radio_probe() calls v4l2_device_register() early to associate the driver instance with the V4L2 (Video for Linux 2) framework. This call takes a reference on the parent device.

The probe function then proceeds to allocate V4L2 controls and register the video device node. If either of these later steps fails, control flow jumps to an exit label that only frees the control handler. The corresponding v4l2_device_unregister() call lives inside si476x_radio_remove(), which the kernel does not invoke when probe itself fails.

The result is a persistent device reference and an unreleased V4L2 registration. Repeated failed probes compound the leak. The upstream patch adds v4l2_device_unregister() to the probe error path after the control handler cleanup, aligning error handling with the successful remove sequence.

Root Cause

The root cause is incomplete error-path cleanup in si476x_radio_probe(). The function acquires resources in a specific order but the failure path only releases a subset of them, leaving v4l2_device_register() state and its parent reference in place. This is a classic driver initialization ordering defect where acquire and release sequences are not symmetric.

Attack Vector

Triggering the flaw requires probe failure of the radio-si476x driver. The condition is local and depends on driver load behavior rather than remote input. The externally observable impact is a resource leak affecting kernel accounting and device reference counts. No arbitrary code execution or privilege escalation is described in the advisory. Refer to the upstream commits linked below for the exact code changes.

// No verified proof-of-concept code is available for this vulnerability.
// See upstream commits referenced under Patch Information for the applied fix.

Detection Methods for CVE-2026-68215

Indicators of Compromise

Repeated probe failures for the radio-si476x driver in dmesg or the kernel journal
Growing device reference counts for the parent I2C or MFD (Multi-Function Device) node backing the Si476x chip
Kernel warnings from the V4L2 core relating to device registration state after module load or unload cycles

Detection Strategies

Audit installed kernel versions across Linux endpoints and compare against the fixed builds referenced in the upstream commits
Review kernel logs for si476x probe error messages combined with absent corresponding remove events
Use lsmod and driver metadata to identify systems that load radio-si476x and prioritize them for patching

Monitoring Recommendations

Forward kernel logs (journald, syslog) to a centralized log platform for correlation of driver probe failures across the fleet
Track kernel package versions as part of standard configuration drift monitoring
Alert on repeated module load failures for media drivers on systems where such drivers are unexpected

How to Mitigate CVE-2026-68215

Immediate Actions Required

Apply the vendor-supplied kernel update for the relevant stable branch as soon as it is available in your distribution
Inventory systems that build with CONFIG_RADIO_SI476X and prioritize those receiving Silicon Labs FM radio hardware
Where the driver is unnecessary, blacklist radio-si476x to prevent probe attempts that could trigger the leak

Patch Information

The fix has been merged into the upstream Linux kernel and backported across multiple stable trees. The referenced commits are 436a693, 4ca9c9f, 64cb158, 730c235, and 7ef9f16. See the Kernel Git Commit 436a693, Kernel Git Commit 4ca9c9f, Kernel Git Commit 64cb158, Kernel Git Commit 730c235, and Kernel Git Commit 7ef9f16 for the exact code changes.

Workarounds

Prevent module autoload by adding blacklist radio-si476x to /etc/modprobe.d/ on systems that do not use Si476x hardware
Rebuild custom kernels with CONFIG_RADIO_SI476X=n where the driver is not required
Avoid repeated manual modprobe cycles of the driver on unpatched systems to limit reference count drift

bash

# Blacklist the affected driver on unpatched systems
echo "blacklist radio-si476x" | sudo tee /etc/modprobe.d/blacklist-si476x.conf
sudo depmod -a
sudo update-initramfs -u