Memory Leak Vulnerability in Meson Video Decoder Driver

The vulnerability, identified as CVE-2026-68223, exists within the vdec_open function of the meson video decoder (vdec) driver. The flaw manifests during error handling paths where memory allocated for internal structures is not correctly released before exiting the function. An attacker with local access to the system who is able to repeatedly trigger the vdec_open error condition can force the kernel to exhaust available memory, eventually leading to a system-wide denial-of-service. This issue is specific to the kernel-mode driver component and requires the ability to interact with the device driver interface.

Impact

Successful exploitation results in a local denial-of-service (DoS) condition, impacting system availability for all users and services. While this vulnerability requires local access, it is particularly relevant for systems where untrusted users may execute code that interacts with hardware abstraction layers. The impact is primarily a system crash or system instability due to kernel memory exhaustion.

Recommendation

Prioritize the application of vendor-provided kernel security patches containing the fix for CVE-2026-68223. Perform a risk assessment to identify Linux systems using the affected meson video decoder hardware/drivers that are exposed to unprivileged users. Ensure that kernel auditing and monitoring are enabled to track frequent system crashes or memory-related panics.