CVE-2026-68221
In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcm_video_probe() allocates the npcm_video structure with kzalloc_obj() but never frees it on any probe error path or in npcm_video_remove(), leaking the allocation on every failed probe and every normal unbind. Additionally, when npcm_video_setup_video() fails, the reserved memory association established by of_reserved_mem_device_init() in npcm_video_init() is not released, leaking the rmem_assigned_device entry on the global list. Fix both by adding kfree(video) to all probe error paths and to npcm_video_remove(), and adding the missing of_reserved_mem_device_release() call when npcm_video_setup_video() fails.
Affected versions
Linux kernel versions
6.7
and later are affected. Fixed in
6.12.101,
6.18.42,
7.1.6,
7.2
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-68221?
CVE-2026-68221 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.7 onward and has been patched in 6.12.101, 6.18.42, 7.1.6 and others. CVE-2026-68221 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-68221?
Yes. CVE-2026-68221 has been patched. Fixed versions include 6.12.101, 6.18.42, 7.1.6 and others. If you are running Linux kernel 6.7 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-68221 actively exploited?
No. CVE-2026-68221 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.