Technical impact
A memory leak exists in Linux's Tegra video driver function __tegra_channel_try_format(). The bug occurs when v4l2_subdev_call() fails and the allocated state object is not freed, violating cleanup requirements and consuming kernel memory over time. This flaw falls under CWE-772 (Improper Resource Shutdown or Release) and CWE-401 (Memory Leak). The leak can lead to gradual system slowdown or a full denial of service, but does not provide direct code execution or privilege escalation.
Affected Systems
Linux systems that use the Tegra video subsystem and include the legacy __tegra_channel_try_format() implementation are affected. Any kernel version prior to the commit that introduced the cleanup label and proper deallocation is vulnerable. Devices employing Tegra hardware or applications that load the Tegra video driver are at risk.
Risk and Exploitability
The vulnerability can be exploited through local interaction with an application or service that triggers __tegra_channel_try_format(). The CVE description does not specify required privilege levels; it is inferred that an attacker would need at least local access to invoke the vulnerable path, though the exact access requirement is not clarified. The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a very low exploitation probability. The issue is not listed in the CISA KEV catalog.
Ubuntu USN