SB20260812343 - Improper resource shutdown or release in Linux kernel test-drivers vivid driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-68203)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in vivid_init() in drivers/media/test-drivers/vivid/vivid-core.c when handling error paths during device and driver initialization. A local user can trigger initialization failure conditions to cause a denial of service.

The issue involves a device reference leak on platform_device_register() failure and incorrect cleanup after successful driver registration when workqueue creation fails.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1349af7f87df57940619f5b87990b799dac9ed8a
• https://git.kernel.org/stable/c/4385092a86b94e1f332db35a3766108978c0722f
• https://git.kernel.org/stable/c/6d51ad8f1c50c50d1abcc97fd243179967184c6a
• https://git.kernel.org/stable/c/a07c179a92e949172ca52f6d4a13202ea88cd4b7