CVE-2026-43202

The Linux kernel framebuffer driver vt8500lcdfb allocates a screen buffer with dma_alloc_coherent() but fails to release it when an error occurs during initialization. This oversight causes a kernel‑level memory leak that persists until the driver is reloaded or the system reboots. The flaw does not expose an easy path to code execution, privilege escalation, or data disclosure; its primary effect is the gradual consumption of kernel memory, which over time could degrade performance or contribute to a denial‑of‑service. The weakness is consistent with CWE‑772, an improper release of resources.

Any Linux kernel build that includes the vt8500lcdfb framebuffer module and has not yet incorporated the upstream fix is susceptible. No specific kernel version numbers are enumerated, so all distributions, custom images, or unpatched custom kernels that load this driver remain at risk until the patch is applied.

The EPSS score for this vulnerability is below 1% and it is not listed in the CISA KEV catalog, indicating low current exploitation activity. The CVSS score of 5.5 reflects moderate severity. The likely attack vector is local, requiring the ability to load or force the vt8500lcdfb module and trigger its initialization failure. Because the leak is incremental, the risk is low‑moderate; an attacker could potentially accelerate resource exhaustion over extended operation, but immediate impact from unauthorized access is unlikely.