SB20260828120 - Memory leak in Linux kernel atomisp i2c driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-80650)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in gc2235_probe() error paths in the atomisp gc2235 driver when cleanup is performed after partial initialization failures. A local user can trigger a failing probe path to cause a denial of service.

The issue includes leaked device resources and cleanup routines being invoked for resources that were not initialized on every error path.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/628f763aee0047ff44974388d6f70f75a763026b
• https://git.kernel.org/stable/c/d57e67ea48e4d095052f2b14d8dd7593621f862f
• https://git.kernel.org/stable/c/f614bf0a64aa1cb7444d152a96798a6bf1d49e1f
• https://git.kernel.org/stable/c/fdbb8e55578b4ab647fa58827a9dd8730d7f4add