Skip to main content

Linux Kernel CVE-2026-43183

| EUVDEUVD-2026-27745 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-rfv7-274m-vphw
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
3.3 LOW

Hardware prerequisite and error-path-only trigger reduce availability impact to Low; all other metrics align with local, low-privilege, no-interaction access.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:06 vuln.today
CVSS changed
May 11, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: cx25821: Fix a resource leak in cx25821_dev_setup()

Add release_mem_region() if ioremap() fails to release the memory region obtained by cx25821_get_resources().

AnalysisAI

Resource leak in the Linux kernel cx25821 media driver allows a local low-privileged user on a system with CX25821 video capture hardware to degrade system availability by exhausting kernel I/O memory regions. The flaw exists in cx25821_dev_setup() where a call to release_mem_region() is missing on the ioremap() failure path, leaving a memory region claimed by cx25821_get_resources() permanently unreleased. No public exploit code exists and EPSS sits at 0.02% (7th percentile), confirming this as a low-exploitation-risk maintenance fix rather than an active threat; patches are available across all active stable kernel branches.

Technical ContextAI

The cx25821 driver (drivers/media/pci/cx25821/) supports Conexant CX25821-based multi-channel PCI video capture and playback cards within the Linux kernel media subsystem. The vulnerability is a CWE-401 (Missing Release of Memory after Effective Lifetime) defect: cx25821_dev_setup() calls cx25821_get_resources() to claim a PCI memory region via request_mem_region(), then calls ioremap() to map it into kernel virtual address space. On ioremap() failure, the error-handling path returns without calling release_mem_region(), leaking the claimed I/O memory resource. This pattern - acquiring a resource before the step that can fail, then omitting the release on that failure branch - is a classic kernel driver error-path bug. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the full range of affected kernel versions from initial repository history through the respective fix commits.

RemediationAI

Upgrade to a patched kernel version matching your active stable branch: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0. Individual fix commits are available at git.kernel.org/stable (see references: 9f1c926248bd, 071bfc6e723a, f7759eb6738e, 4010e596d23c, e220ec4c4596, b7210170b10e, 80ce3797dc99, 68cd8ac994ca). Ubuntu users should apply the kernel update referenced in USN-8492-1 at https://ubuntu.com/security/notices/USN-8492-1. On systems that do not use CX25821 video capture hardware, blacklisting the cx25821 kernel module (add 'blacklist cx25821' to /etc/modprobe.d/blacklist.conf and run 'depmod -a') eliminates the vulnerable code path entirely with no functional impact; this is an effective compensating control until a patched kernel can be deployed.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43183 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy