CVE-2026-68220 Overview
CVE-2026-68220 is a memory leak vulnerability in the Linux kernel's NXP i.MX8 Image Sensor Interface (ISI) media driver. The flaw resides in the mxc_isi_crossbar_cleanup() and mxc_isi_pipe_cleanup() functions. Both cleanup paths fail to invoke v4l2_subdev_cleanup() to release the V4L2 subdev active state allocated during initialization by v4l2_subdev_init_finalize(). Each module unload (rmmod) leaks kernel memory, as confirmed by kmemleak reports. The upstream Linux kernel maintainers have resolved the issue in the mainline and stable branches.
Critical Impact
Repeated module load and unload cycles progressively exhaust kernel memory on systems using the NXP i.MX8 ISI media driver, degrading availability over time.
Affected Products
- Linux kernel media: nxp: imx8-isi driver
- Systems running NXP i.MX8 platforms with the ISI subsystem enabled
- Stable kernel branches prior to the fixing commits referenced by the Linux kernel maintainers
Discovery Timeline
- 2026-08-10 - CVE-2026-68220 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68220
Vulnerability Analysis
The vulnerability originates in the drivers/media/platform/nxp/imx8-isi subsystem. During initialization, both mxc_isi_crossbar_init() and mxc_isi_pipe_init() call v4l2_subdev_init_finalize(). This routine allocates the subdev active state through __v4l2_subdev_state_alloc(), which internally invokes __kvmalloc_node_noprof() to reserve a 192-byte structure per subdev.
On driver teardown, the corresponding cleanup functions mxc_isi_crossbar_cleanup() and mxc_isi_pipe_cleanup() proceed directly to media_entity_cleanup() without calling v4l2_subdev_cleanup(). The active state buffer remains allocated in kernel memory. kmemleak reports the unreferenced 192-byte object with a stack trace pointing to __v4l2_subdev_init_finalize.
The defect maps to Memory Leak [CWE-401]. It does not corrupt memory, escalate privileges, or allow code execution. Impact is limited to resource exhaustion on systems that repeatedly bind and unbind the driver.
Root Cause
The cleanup paths are asymmetric with respect to the initialization paths. v4l2_subdev_init_finalize() establishes state that must be paired with v4l2_subdev_cleanup() to release the allocation. The imx8-isi crossbar and pipe cleanup routines omitted this call, breaking the acquire-release symmetry required by the V4L2 subdev API contract.
Attack Vector
Triggering the leak requires local access with privileges to load and unload kernel modules, typically root. Each rmmod cycle leaks 192 bytes per subdev instance. There is no remote attack surface. Exploitation is limited to denial-of-service through gradual memory exhaustion on long-lived systems or automated test rigs that reload the driver frequently.
The vulnerability mechanism is documented in the upstream fix commits. See the Linux Kernel Commit Update for the patch that adds the missing cleanup calls.
Detection Methods for CVE-2026-68220
Indicators of Compromise
- kmemleak reports referencing __v4l2_subdev_state_alloc and __v4l2_subdev_init_finalize in the backtrace after imx8-isi module unload
- Growth of unreclaimable kernel slab allocations correlated with rmmod events on the imx8-isi driver
- Progressive decline in MemAvailable reported by /proc/meminfo on affected NXP i.MX8 hosts
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK on test kernels and scan /sys/kernel/debug/kmemleak after driver reload cycles
- Monitor kernel version and driver source against the fixing commits published on git.kernel.org
- Audit build manifests for embedded systems shipping NXP i.MX8 SoCs to confirm the ISI driver includes the upstream fix
Monitoring Recommendations
- Track slab allocation trends with slabtop and node exporter metrics on production i.MX8 devices
- Alert on repeated bind/unbind events for the imx8-isi platform driver in system logs
- Correlate memory pressure events with camera subsystem module lifecycle activity in the Singularity Data Lake for long-term trend analysis
How to Mitigate CVE-2026-68220
Immediate Actions Required
- Apply the upstream Linux kernel patches that add v4l2_subdev_cleanup() calls to mxc_isi_crossbar_cleanup() and mxc_isi_pipe_cleanup()
- Rebuild and deploy kernels for NXP i.MX8 devices from a stable branch that includes the fix
- Avoid repeated module unload cycles on unpatched systems until the fix is deployed
Patch Information
The Linux kernel maintainers have merged fixes across multiple stable branches. Reference commits include 549dd1afce2c, 567418eedd25, 9c5ddbabc31f, 9e61258fbc3c, and f04ec9860542. Each patch adds the missing v4l2_subdev_cleanup() call before media_entity_cleanup() in the affected paths.
Workarounds
- Keep the imx8-isi driver loaded persistently rather than cycling it, minimizing the number of leaked allocations
- Reboot affected hosts periodically to reclaim leaked kernel memory until patched kernels are available
- Restrict access to module management operations to trusted administrators through CAP_SYS_MODULE controls
# Verify whether the running kernel contains the fix
zgrep -E 'imx8-isi|v4l2_subdev_cleanup' /proc/config.gz
uname -r
# Inspect kmemleak output after a driver reload cycle
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak | grep -A5 v4l2_subdev
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
