CVE-2026-93071
In the Linux kernel, the following vulnerability has been resolved: media: bcm2835-unicam: Fix asc leaked in error/remove path v4l2_async_nf_add_fwnode_remote() allocates the asc, which is freed when v4l2_async_nf_cleanup() is called. Call v4l2_async_nf_cleanup() properly in the driver paths. Discovered with kmemleak after rmmod: unreferenced object 0xffff000084526b80 (size 64): comm "modprobe", pid 185, jiffies 4295013512 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 e8 0d ff bf 00 00 ff ff ................ 40 83 bc 84 00 00 ff ff 60 83 bc 84 00 00 ff ff @.......`....... backtrace (crc ac584083): [<00000000ffb081a7>] kmemleak_alloc+0x38/0x44 [<00000000d2fd9301>] __kmalloc+0x1b0/0x250 [<000000004dd5354d>] __v4l2_async_nf_add_fwnode+0x28/0x9c [<0000000067587657>] __v4l2_async_nf_add_fwnode_remote+0x3c/0x64
Affected versions
Linux kernel versions
6.10
and later are affected. Fixed in
6.12.110,
6.18.52,
7.2.6,
7.3-rc1
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-93071?
CVE-2026-93071 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.10 onward and has been patched in 6.12.110, 6.18.52, 7.2.6 and others. CVE-2026-93071 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-93071?
Yes. CVE-2026-93071 has been patched. Fixed versions include 6.12.110, 6.18.52, 7.2.6 and others. If you are running Linux kernel 6.10 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-93071 actively exploited?
No. CVE-2026-93071 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.