Skip to main content

Linux Kernel EUVDEUVD-2026-27790

| CVE-2026-43231 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-gqg8-ww6w-xc5v
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Error-path-only trigger and need to induce registration failure consistently warrants AC:H; all other metrics align with the provided vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:57 vuln.today
CVSS changed
May 08, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: radio-keene: fix memory leak in error path

Fix a memory leak in usb_keene_probe(). The v4l2 control handler is initialized and controls are added, but if v4l2_device_register() or video_register_device() fails afterward, the handler was never freed, leaking memory.

Add v4l2_ctrl_handler_free() call in the err_v4l2 error path to ensure the control handler is properly freed for all error paths after it is initialized.

AnalysisAI

Memory leak in the Linux kernel's radio-keene USB FM transmitter driver (radio-keene.c) leaves a v4l2 control handler unfreed when either v4l2_device_register() or video_register_device() fails during device probe. Affected kernel versions range from the commit introducing the flaw (1bf20c3a0c616f44359c573b533d06bae960ee45) through multiple stable branches, with fixed versions confirmed across 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) confirms negligible real-world exploitation probability.

Technical ContextAI

The radio-keene driver (drivers/media/radio/radio-keene.c) handles Keene FM Transmitter USB devices via the V4L2 (Video4Linux2) media subsystem. During device probe in usb_keene_probe(), the driver allocates and initializes a v4l2_ctrl_handler structure used to manage V4L2 controls, then registers the device via v4l2_device_register() and video_register_device(). The vulnerability, classified as CWE-401 (Missing Release of Memory after Effective Lifetime), arises because the error path labeled err_v4l2 - which handles failures from those registration calls - did not call v4l2_ctrl_handler_free() before returning. The fix adds this call to properly release the control handler allocation in all error paths after initialization. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, covering Linux kernel versions from the offending commit forward across stable branches including 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, and 6.19.x. The 'Information Disclosure' tag in EUVD metadata appears to be a misclassification - CVSS confirms C:N and I:N; only availability is impacted via memory exhaustion.

RemediationAI

The primary fix is to upgrade to a patched stable kernel version: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0, depending on the branch in use. The upstream kernel commits are available at https://git.kernel.org/stable/c/ad85bb5623079a35bd400f51de2e2fbc2170bdb2, https://git.kernel.org/stable/c/242b0aabb1866024a7995a767ac330c158b39aa4, and several others indexed under the CVE. Ubuntu users should apply USN-8492-1. Red Hat and SUSE customers should monitor their respective security advisories for kernel updates incorporating these stable patches. If patching is not immediately possible, the only effective compensating control is to prevent the radio-keene kernel module from loading by blacklisting it (add 'blacklist radio-keene' to /etc/modprobe.d/blacklist.conf and run depmod -a), which eliminates the vulnerable code path entirely. The trade-off is loss of Keene FM Transmitter USB device functionality, which is unlikely to affect enterprise systems. Do not rely on USB port restriction alone, as the module could still be loaded manually.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27790 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy