CVE-2026-45928
Published: May 27, 2026· Updated: May 27, 2026
Official Description
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Fix memory leak on codec_info allocation failure
In wave5_vpu_open_enc() and wave5_vpu_open_dec(), a vpu instance is
allocated via kzalloc(). If the subsequent allocation for inst->codec_info
fails, the functions return -ENOMEM without freeing the previously
allocated instance, causing a memory leak.
Fix this by calling kfree() on the instance in this error path to ensure
it is properly released.
Technical Analysis
CVE-2026-45928 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
Affected Vendors & Products
Exploit & PoC Resources
All References (4)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-45928 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts