PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45939 Linux CVE debrief

A memory leak vulnerability in the Linux kernel's GPIB (General Purpose Interface Bus) subsystem has been resolved. The issue occurred in the `ni_usb_init()` function within the National Instruments USB-GPIB driver. If `ni_usb_setup_init()` failed during initialization, the function returned `-EFAULT` without freeing the previously allocated `writes` buffer, resulting in a memory leak. Additionally, `ni_usb_setup_init()` incorrectly returned `0` on failure, causing `ni_usb_init()` to return the inappropriate error code `-EFAULT`. The fix addresses both issues: the `writes` buffer is now properly freed in the error path, and `ni_usb_setup_init()` has been modified to return `-EINVAL` on failure, which is then propagated by `ni_usb_init()`. This vulnerability affects systems using National Instruments USB-GPIB hardware with the Linux kernel GPIB driver. The fix has been applied to stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

System administrators running Linux systems with National Instruments USB-GPIB hardware; kernel maintainers and developers working with the GPIB subsystem; embedded systems engineers utilizing GPIB instrumentation interfaces.

Technical summary

The vulnerability exists in `drivers/gpib/ni_usb/ni_usb_gpib.c` in the Linux kernel. The `ni_usb_init()` function allocates a `writes` buffer via `kmalloc()` or similar allocation mechanism. If the subsequent `ni_usb_setup_init()` call fails, the original code returned `-EFAULT` without freeing `writes`, causing a memory leak. Additionally, `ni_usb_setup_init()` returned `0` on failure rather than a negative error code, which was semantically incorrect and led to the inappropriate `-EFAULT` return. The fix ensures `writes` is freed via `kfree()` or equivalent in the error path, and modifies `ni_usb_setup_init()` to return `-EINVAL` on failure, which `ni_usb_init()` now propagates correctly. This improves both memory safety and error reporting in the GPIB driver initialization path.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and confirm if the National Instruments USB-GPIB driver (ni_usb_gpib) is in use on affected systems
  • Apply kernel updates containing the fix commits once available through distribution channels
  • Monitor system memory usage on systems utilizing USB-GPIB hardware for signs of memory exhaustion during driver initialization failures
  • Verify error handling behavior in custom kernel builds that include the GPIB subsystem

Evidence notes

Vulnerability description confirms memory leak in `ni_usb_init()` when `ni_usb_setup_init()` fails, with improper error code handling. Kernel.org git commits provided as references confirm the fix implementation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45939 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45939

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45939 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45939

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9c97fcfb7a62dea893104a046d544da8ac23370b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b89921eed8cf2d97250bac4be38dbcfbf048b586

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c899d4b62c0757a280831e89c1f3801b597e8f38

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.