CVE-2026-45928

MediumCVSS 5.5/10Last modified Jun 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: chips-media: wave5: Fix memory leak on codec_info allocation failure

In wave5_vpu_open_enc() and wave5_vpu_open_dec(), a vpu instance is allocated via kzalloc(). If the subsequent allocation for inst->codec_info fails, the functions return -ENOMEM without freeing the previously allocated instance, causing a memory leak.

Fix this by calling kfree() on the instance in this error path to ensure it is properly released.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 9707a6254a8a6b978bde811a44fe07d86c229d1c, < 52defdd4034db1a34bb48006f889d66a3629224b; >= 9707a6254a8a6b978bde811a44fe07d86c229d1c, < 1de71556cbd6e1d0d26fb86b9b3bb8caa0df8495; >= 9707a6254a8a6b978bde811a44fe07d86c229d1c, < 32e9e45cf7e3422d21fa64535588d3572faf71c3; >= 9707a6254a8a6b978bde811a44fe07d86c229d1c, < a519e21e32398459ba357e67b541402f7295ee1b
LinuxLinux6.8

References

Timeline

Published
May 27, 2026
Last modified
Jun 25, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-459297.8In the Linux kernel, the following vulnerability has been resolved: ovpn: fix possible use-after-free in ovpn_net_xmit When building the sCVE-2026-45936.3A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the file erupt-ai/src/maiCVE-2026-459305.5In the Linux kernel, the following vulnerability has been resolved: net: mctp: ensure our nlmsg responses are initialised Syed Faraz AbrarCVE-2026-459317.8In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Hold mm structure across iommu_sva_unbind_device() SomeCVE-2026-459327.3In the Linux kernel, the following vulnerability has been resolved: bpf: Fix tcx/netkit detach permissions when prog fd isn't given This cCVE-2026-459337.8In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve id of register in sync_linked_regs() sync_linked_regs() CVE-2026-459345.5In the Linux kernel, the following vulnerability has been resolved: btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocationCVE-2026-459357.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'CVE-2026-459367.8In the Linux kernel, the following vulnerability has been resolved: power: supply: goldfish: Fix use-after-free in power_supply_changed() CVE-2026-459375.5In the Linux kernel, the following vulnerability has been resolved: crypto: inside-secure/eip93 - fix kernel panic in driver detach DuringCVE-2026-459387.8In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()CVE-2026-459395.5In the Linux kernel, the following vulnerability has been resolved: gpib: Fix memory leak in ni_usb_init() In ni_usb_init(), if ni_usb_set
CVE-2026-45928: Medium severity, CVSS 5.5 | Vulnix