Skip to main content

Linux Kernel EUVDEUVD-2026-32341

| CVE-2026-45875 MEDIUM
Memory Leak (CWE-401)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-jvj6-qwx6-7f2x
Linux Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only vector requiring hardware presence and low-privilege access; no confidentiality or integrity impact, only availability from kernel resource exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 25, 2026 - 21:16 vuln.today
CVSS changed
Jun 25, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure

The wm5102_clear_write_sequencer() helper may return an error and just return, bypassing the cleanup sequence and causing regulators to remain enabled, leading to a resource leak.

Change the direct return to jump to the err_reset label to properly free the resources.

AnalysisAI

Regulator resource leak in the Linux kernel MFD Arizona WM5102 audio codec driver causes availability degradation on affected hardware when the write sequencer error path is triggered. The wm5102_clear_write_sequencer() helper returns early on error without jumping to the err_reset cleanup label, leaving kernel voltage regulators enabled and leaking resources across repeated invocations. Exploitation requires local low-privilege access on systems with WM5102 hardware; EPSS is 0.02% (7th percentile) and no active exploitation has been identified, placing real-world priority firmly in the low tier.

Technical ContextAI

The vulnerable component is the Multi-Function Device (MFD) Arizona subsystem driver for the Wolfson/Cirrus Logic WM5102 audio hub codec, present in specific mobile and embedded platforms (CPE: cpe:2.3:o:linux:linux_kernel). The root cause class is CWE-401 (Missing Release of Memory after Effective Lifetime): a control-flow defect in wm5102_clear_write_sequencer() allows an early return on error, bypassing the err_reset label that is responsible for disabling and releasing kernel regulator references. The WM5102 manages power rails for audio subsystems on devices such as the Samsung Galaxy S6 series; voltage regulators are kernel-managed resources that must be explicitly released. Failure to release them over repeated error invocations can exhaust reference counts and cause kernel-level resource exhaustion in the audio subsystem.

RemediationAI

The primary fix is upgrading to a patched Linux kernel release: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4, or 7.0. Upstream patch commits are available at https://git.kernel.org/stable/c/2049820d1e635e467d795237fd40287213d92349 and the seven additional stable-branch commits listed in the references. For systems that cannot be patched immediately, unloading or blacklisting the arizona MFD kernel module (modprobe -r arizona) eliminates the vulnerable code path entirely but also disables WM5102 audio functionality - acceptable on servers or embedded systems where this hardware is absent or unused. Restricting local user access to audio device nodes in /dev reduces exposure but does not eliminate the kernel-side resource leak on error paths.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-32341 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy