SB20260812314 - Improper resource shutdown or release in Linux kernel meson vdec driver
Published: August 12, 2026
Security Bulletin ID
SB20260812314
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper resource shutdown or release (CVE-ID: CVE-2026-68223)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in the vdec_open() function when opening the video decoder device and initialization of controls fails. A local user can open the device to cause a denial of service.
The issue occurs in the error path after m2m context allocation, resulting in a kernel memory leak.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/1391b75bf0119b5d37f1c1c3078d452a01967f9b
- https://git.kernel.org/stable/c/2cf0171ad594860e31723c671e37824ce12c01ea
- https://git.kernel.org/stable/c/940f161f734b25f175a95d2684c2021f6323693a
- https://git.kernel.org/stable/c/99f3527bd1a27ff798d59177ed045b0dd87deaef
- https://git.kernel.org/stable/c/c6cd08a71a630f19b10c318e76e3c56e1dd10e00