Skip to main content

Linux Kernel EUVDEUVD-2026-27803

| CVE-2026-43242 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-qfjr-vf3f-5f8g
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 11, 2026 - 14:37 vuln.today
CVSS changed
May 11, 2026 - 14:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

soc: ti: k3-socinfo: Fix regmap leak on probe failure

The mmio regmap allocated during probe is never freed.

Switch to using the device managed allocator so that the regmap is released on probe failures (e.g. probe deferral) and on driver unbind.

AnalysisAI

Memory leak in the Linux kernel's TI K3 SoC info driver (soc/ti/k3-socinfo) fails to release an allocated mmio regmap, causing denial of service through resource exhaustion on probe failures and driver unbind. Local attackers with low privileges can trigger probe deferral or driver unbind to exhaust kernel memory, affecting systems running vulnerable Linux kernel versions. The vulnerability has a low EPSS score (0.02%) but enables practical local DoS against systems where low-privilege users can control driver lifecycle.

Technical ContextAI

The vulnerability resides in the TI K3 SoC info driver (soc/ti/k3-socinfo), a Texas Instruments SoC identification driver in the Linux kernel's drivers/soc/ti/ subsystem. The driver allocates a memory-mapped I/O (mmio) regmap during probe but fails to properly free this allocation when probe fails (e.g., due to probe deferral) or when the driver unbinds. This is a classic resource leak pattern (CWE-401: Missing Release of Memory after Effective Lifetime) where kernel memory allocated via regmap allocation is never returned to the pool. The fix involves switching from standard allocators to device-managed allocators (devm_* functions), which automatically release resources when the device is removed or probe fails. The TI K3 SoC family is used in various embedded and automotive processors where resource constraints amplify the impact of memory leaks.

RemediationAI

Upgrade the Linux kernel to patched versions: 5.10.252 or later for 5.10.x, 5.15.202 or later for 5.15.x, 6.1.165 or later for 6.1.x, 6.6.128 or later for 6.6.x, 6.12.75 or later for 6.12.x, 6.18.16 or later for 6.18.x, 6.19.6 or later for 6.19.x, or 7.0 or later. The fix applies to the soc/ti/k3-socinfo driver and is available via stable kernel branches at git.kernel.org (see references for specific commit hashes: c97c21d342838b2a7787b0f1d6ad417e85c906f6 and related backports). For systems unable to patch immediately, no effective workaround exists short of disabling the K3 SoC info driver module if not required for system operation (verify driver necessity first-it is typically loaded early for system identification). Monitor kernel memory usage and watch for memory pressure warnings on production systems; repeated memory pressure events may indicate exploitation or normal memory leak progression in unpatched systems. Verify patch installation by confirming kernel version matches patched release or by checking the presence of devm_regmap_init_mmio() usage in the k3-socinfo driver source.

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27803 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy