PatchSiren cyber security CVE debrief
CVE-2026-45954 Linux CVE debrief
A memory leak vulnerability exists in the Linux kernel's au1200fb framebuffer driver. The flaw occurs in the `au1200fb_drv_probe()` function, where a direct return on `platform_get_irq()` failure bypasses necessary cleanup, causing allocated memory to leak. The fix replaces the direct return with a goto label to ensure proper resource cleanup on error paths. This vulnerability affects the fbdev au1200fb driver and was resolved via kernel patches.
- Vendor
- Linux
- Product
- Unknown
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-06-16
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-06-16
Who should care
Organizations running embedded Linux systems with AMD/Alchemy AU1200 SoCs utilizing the au1200fb framebuffer driver; kernel maintainers and Linux distribution security teams responsible for stable kernel updates
Technical summary
The au1200fb framebuffer driver in the Linux kernel contains a memory leak vulnerability in its probe function. When `platform_get_irq()` fails during driver initialization, the original code returns directly without freeing previously allocated resources. The vulnerability is classified as a resource management issue affecting error handling paths. The fix introduces proper cleanup via goto labels to ensure all allocated memory is freed when initialization fails. This vulnerability is specific to the AMD/Alchemy AU1200 SoC framebuffer driver and requires local access to trigger during driver loading.
Defensive priority
low
Recommended defensive actions
- Apply kernel updates containing the referenced stable commits when available from your Linux distribution
- Monitor distribution security advisories for kernel package updates addressing CVE-2026-45954
- Review systems using the au1200fb framebuffer driver on AMD/Alchemy AU1200 platforms
- Consider disabling the au1200fb driver if not required for embedded/legacy hardware operation
Evidence notes
The vulnerability description indicates a memory leak in `au1200fb_drv_probe()` when `platform_get_irq()` fails, with the fix implemented via goto-based cleanup. Multiple stable kernel commits are referenced, suggesting backports to various kernel versions.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-45954 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-45954
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-45954 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45954
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/071d8fb757a8318f72c8e02898c2cf7e14e21fb6
416baaa9-dc9f-4396-8d5f-8c081fb06d67
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/3d4202ee6494c0d576cdc104b12e0834ca8136a8
416baaa9-dc9f-4396-8d5f-8c081fb06d67
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/3e5349e54113e2dce1a659c57935e18032742e56
416baaa9-dc9f-4396-8d5f-8c081fb06d67
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/762a26818934241b8b0172a229d2cf5d87260e40
416baaa9-dc9f-4396-8d5f-8c081fb06d67
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/81831d56b723bc1090ce3158feddaca88e85f939
416baaa9-dc9f-4396-8d5f-8c081fb06d67
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/b024a8efee0f55d330a1cdd3eac8f79ac5acd3be
416baaa9-dc9f-4396-8d5f-8c081fb06d67
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/bd1ad63e11b2a568e98de536f319054d2de29f56
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.