CVE-2026-80974: Linux Kernel Memory Leak Vulnerability

CVE-2026-80974 Overview

CVE-2026-80974 is a memory leak vulnerability in the Linux kernel's sm501 multi-function device (MFD) driver. The flaw resides in the driver's device removal paths. Memory allocated for the struct sm501_devdata structure during sm501_pci_probe() and sm501_plat_probe() is not released by the corresponding sm501_pci_remove() and sm501_plat_remove() functions. Each probe/remove cycle leaks kernel memory, gradually reducing available system resources on systems that repeatedly bind and unbind the affected driver.

Critical Impact
Repeated bind/unbind cycles of the sm501 driver progressively exhaust kernel memory, potentially degrading system stability over time.

Affected Products

Linux kernel builds including the mfd/sm501 driver prior to the fix commits
Systems using Silicon Motion SM501 multimedia companion chips via PCI or platform bus
Long-running Linux systems that repeatedly probe/remove the sm501 device

Discovery Timeline

2026-09-11 - CVE-2026-80974 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80974

Vulnerability Analysis

The Linux kernel mfd/sm501 driver supports the Silicon Motion SM501 companion chip through two bus interfaces: PCI and platform. Both probe routines, sm501_pci_probe() and sm501_plat_probe(), allocate a struct sm501_devdata instance to hold per-device state.

When the driver is unbound or the device is removed, sm501_pci_remove() and sm501_plat_remove() tear down the device but omit the corresponding kfree() call for sm501_devdata. Every probe-then-remove sequence therefore leaks one allocation from the kernel slab allocator.

On short-lived systems the impact is bounded. On systems where the driver binds and unbinds repeatedly, for example through module reloads, hotplug events, or automated hardware tests, the leak accumulates and consumes kernel memory that cannot be reclaimed until reboot.

Root Cause

The root cause is an unbalanced allocation lifecycle in the driver's teardown path [CWE-401: Missing Release of Memory after Effective Lifetime]. The probe functions allocate struct sm501_devdata, but the matching remove callbacks fail to invoke kfree() on that structure. The fix adds explicit kfree() calls to both remove functions, restoring symmetry between allocation and release.

Attack Vector

Exploitation requires local access with the ability to trigger driver bind/unbind operations, typically limited to privileged users. The vulnerability does not enable code execution or privilege escalation. The practical impact is resource exhaustion resulting in a slow denial-of-service condition on systems where the sm501 driver is repeatedly loaded and removed.

The vulnerability is described in prose only; refer to the upstream commits for the exact code changes:

Detection Methods for CVE-2026-80974

Indicators of Compromise

Steady growth in kernel slab usage reported by /proc/slabinfo correlated with sm501 driver bind/unbind events
Repeated sm501 messages in dmesg accompanying module load/unload cycles
Declining MemAvailable in /proc/meminfo on hosts that exercise the sm501 driver in test loops

Detection Strategies

Enable kmemleak (CONFIG_DEBUG_KMEMLEAK) on test kernels and inspect /sys/kernel/debug/kmemleak for unreferenced allocations attributed to sm501_pci_probe or sm501_plat_probe
Compare the running kernel version and sm501 driver source against the upstream fix commits listed above
Audit build configurations for CONFIG_MFD_SM501=y or =m on systems that do not require the hardware

Monitoring Recommendations

Track kernel memory metrics over time and alert on abnormal slab growth on hosts with SM501 hardware
Log module load/unload events via auditd rules targeting init_module and delete_module syscalls
Baseline expected sm501 driver behavior and flag deviations such as frequent rebinds

How to Mitigate CVE-2026-80974

Immediate Actions Required

Apply a kernel update that incorporates the upstream fix commits for the mfd/sm501 driver
Restrict module load/unload privileges to trusted administrators using CAP_SYS_MODULE controls
On systems without SM501 hardware, blacklist the sm501 module to eliminate exposure

Patch Information

The fix adds a kfree() call for the struct sm501_devdata allocation in both sm501_pci_remove() and sm501_plat_remove(). The change has been merged upstream and backported to stable kernel branches through the commits referenced above. Distribution vendors incorporate these fixes into their maintained kernel packages; consult the appropriate vendor security advisory for the exact package version containing the backport.

Workarounds

Blacklist the sm501 module via /etc/modprobe.d/ on systems that do not require the hardware
Avoid automated bind/unbind loops of the sm501 driver until the patched kernel is deployed
Reboot systems periodically to reclaim leaked kernel memory as an interim measure

bash

# Blacklist the sm501 module to prevent loading
echo "blacklist sm501" | sudo tee /etc/modprobe.d/blacklist-sm501.conf
sudo depmod -a

# Verify the running kernel version and module status
uname -r
lsmod | grep sm501