CVE-2026-68221 Overview
CVE-2026-68221 is a memory leak vulnerability in the Linux kernel's Nuvoton NPCM video capture driver (drivers/media/platform/nuvoton/npcm-video). The npcm_video_probe() function allocates the npcm_video structure using kzalloc_obj() but never releases it on probe error paths or in npcm_video_remove(). Additionally, when npcm_video_setup_video() fails, the reserved memory association established by of_reserved_mem_device_init() is not released. Each failed probe attempt and every normal driver unbind leaks kernel memory. The issue affects systems using the NPCM BMC video capture driver on Nuvoton platforms.
Critical Impact
Repeated probe failures or driver unbind operations progressively exhaust kernel memory, potentially leading to resource exhaustion and denial of service on affected BMC platforms.
Affected Products
- Linux kernel with Nuvoton NPCM video capture driver (npcm-video) enabled
- Nuvoton NPCM BMC (Baseboard Management Controller) platforms using the video driver
- Distributions shipping the vulnerable driver prior to the upstream fix
Discovery Timeline
- 2026-08-10 - CVE-2026-68221 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68221
Vulnerability Analysis
The vulnerability is a classic kernel memory leak [CWE-401] in resource management logic. The npcm_video_probe() function allocates a npcm_video structure with kzalloc_obj() at initialization. The driver never invokes a corresponding kfree() call on this allocation in any of its probe error return paths or during npcm_video_remove().
A secondary leak involves reserved memory bookkeeping. The driver calls of_reserved_mem_device_init() in npcm_video_init() to associate a reserved memory region with the device. When npcm_video_setup_video() subsequently fails, the driver returns without calling of_reserved_mem_device_release(). This leaves an rmem_assigned_device entry on the kernel's global reserved memory list, leaking bookkeeping state that persists for the lifetime of the running kernel.
Each probe failure and each normal driver unbind compounds the leak. In BMC environments where drivers may be repeatedly probed during firmware bring-up or hot-plug scenarios, cumulative leakage becomes measurable.
Root Cause
The root cause is missing cleanup in error and teardown paths. The probe function allocates resources but does not implement a unified goto-based unwind pattern that releases those resources on failure. The remove callback mirrors this omission and never frees the primary driver context structure.
Attack Vector
Exploitation requires local access with the ability to trigger driver load, unload, or probe operations. An attacker who can cause repeated bind and unbind cycles through sysfs (/sys/bus/platform/drivers/npcm-video/bind and unbind) can amplify the leak. Remote exploitation is not applicable; this is a local resource exhaustion issue rather than a memory corruption primitive.
No verified public proof-of-concept code is available. The vulnerability is described in kernel commit messages associated with the upstream patches referenced below.
Detection Methods for CVE-2026-68221
Indicators of Compromise
- Progressive growth of kernel Slab and SUnreclaim values in /proc/meminfo on systems using the npcm-video driver
- Increasing entries in the reserved memory global list without corresponding device removal
- Repeated driver bind or unbind operations recorded in dmesg for npcm-video
Detection Strategies
- Compare running kernel version against the fixed commits 181a0aeef, 50cc0e54d, 65ddc021d, and b092d690a on affected stable branches
- Use kmemleak on kernels built with CONFIG_DEBUG_KMEMLEAK=y to identify unfreed npcm_video allocations
- Audit BMC firmware images and Linux distributions targeting Nuvoton NPCM platforms for inclusion of the patched driver
Monitoring Recommendations
- Track kernel memory consumption trends on BMC hosts and alert on abnormal Slab growth
- Log platform driver bind and unbind events through auditd rules on affected systems
- Correlate BMC reboot cadence with kernel memory pressure to identify leak-driven instability
How to Mitigate CVE-2026-68221
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by the fix commits to affected stable branches
- Update BMC firmware images that embed the vulnerable npcm-video driver
- Avoid repeated bind and unbind cycles of the npcm-video driver on unpatched systems
Patch Information
The fix adds kfree(video) calls to all probe error paths and to npcm_video_remove(), and adds the missing of_reserved_mem_device_release() call when npcm_video_setup_video() fails. Patches are available in the following upstream commits: Kernel Patch 181a0aeef, Kernel Patch 50cc0e54d, Kernel Patch 65ddc021d, and Kernel Patch b092d690a.
Workarounds
- Disable the npcm-video driver via kernel configuration (CONFIG_VIDEO_NUVOTON_NPCM=n) if video capture is not required
- Blacklist the module on systems where the functionality is not needed to prevent probe attempts
- Schedule reboots on affected BMC hosts to reclaim leaked kernel memory until patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
