PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45954 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's au1200fb framebuffer driver. The flaw occurs in the `au1200fb_drv_probe()` function, where a direct return on `platform_get_irq()` failure bypasses necessary cleanup, causing allocated memory to leak. The fix replaces the direct return with a goto label to ensure proper resource cleanup on error paths. This vulnerability affects the fbdev au1200fb driver and was resolved via kernel patches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations running embedded Linux systems with AMD/Alchemy AU1200 SoCs utilizing the au1200fb framebuffer driver; kernel maintainers and Linux distribution security teams responsible for stable kernel updates

Technical summary

The au1200fb framebuffer driver in the Linux kernel contains a memory leak vulnerability in its probe function. When `platform_get_irq()` fails during driver initialization, the original code returns directly without freeing previously allocated resources. The vulnerability is classified as a resource management issue affecting error handling paths. The fix introduces proper cleanup via goto labels to ensure all allocated memory is freed when initialization fails. This vulnerability is specific to the AMD/Alchemy AU1200 SoC framebuffer driver and requires local access to trigger during driver loading.

Defensive priority

low

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • Monitor distribution security advisories for kernel package updates addressing CVE-2026-45954
  • Review systems using the au1200fb framebuffer driver on AMD/Alchemy AU1200 platforms
  • Consider disabling the au1200fb driver if not required for embedded/legacy hardware operation

Evidence notes

The vulnerability description indicates a memory leak in `au1200fb_drv_probe()` when `platform_get_irq()` fails, with the fix implemented via goto-based cleanup. Multiple stable kernel commits are referenced, suggesting backports to various kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45954 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45954

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45954 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45954

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/071d8fb757a8318f72c8e02898c2cf7e14e21fb6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3d4202ee6494c0d576cdc104b12e0834ca8136a8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3e5349e54113e2dce1a659c57935e18032742e56

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/762a26818934241b8b0172a229d2cf5d87260e40

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/81831d56b723bc1090ce3158feddaca88e85f939

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b024a8efee0f55d330a1cdd3eac8f79ac5acd3be

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bd1ad63e11b2a568e98de536f319054d2de29f56

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.