PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45954 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's au1200fb framebuffer driver. The flaw occurs in the `au1200fb_drv_probe()` function, where a direct return on `platform_get_irq()` failure bypasses necessary cleanup, causing allocated memory to leak. The fix replaces the direct return with a goto label to ensure proper resource cleanup on error paths. This vulnerability affects the fbdev au1200fb driver and was resolved via kernel patches.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running embedded Linux systems with AMD/Alchemy AU1200 SoCs utilizing the au1200fb framebuffer driver; kernel maintainers and Linux distribution security teams responsible for stable kernel updates

Technical summary

The au1200fb framebuffer driver in the Linux kernel contains a memory leak vulnerability in its probe function. When `platform_get_irq()` fails during driver initialization, the original code returns directly without freeing previously allocated resources. The vulnerability is classified as a resource management issue affecting error handling paths. The fix introduces proper cleanup via goto labels to ensure all allocated memory is freed when initialization fails. This vulnerability is specific to the AMD/Alchemy AU1200 SoC framebuffer driver and requires local access to trigger during driver loading.

Defensive priority

low

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • Monitor distribution security advisories for kernel package updates addressing CVE-2026-45954
  • Review systems using the au1200fb framebuffer driver on AMD/Alchemy AU1200 platforms
  • Consider disabling the au1200fb driver if not required for embedded/legacy hardware operation

Evidence notes

The vulnerability description indicates a memory leak in `au1200fb_drv_probe()` when `platform_get_irq()` fails, with the fix implemented via goto-based cleanup. Multiple stable kernel commits are referenced, suggesting backports to various kernel versions.

Official resources

2026-05-27