Description
In the Linux kernel, the following vulnerability has been resolved:

fbdev: vt8500lcdfb: fix missing dma_free_coherent()

fbi->fb.screen_buffer is allocated with dma_alloc_coherent() but is not
freed if the error path is reached.
Published: 2026-05-06
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel framebuffer driver vt8500lcdfb allocates a screen buffer using dma_alloc_coherent(), but the allocated memory is not freed when an error occurs during initialization. This oversight results in a memory leak that persists at kernel level until the driver is reloaded or the system is rebooted. The flaw does not provide an attacker with direct code execution, privilege escalation, or information disclosure, but it can gradually consume kernel‑level memory resources.

Affected Systems

The issue is confined to the Linux kernel and the vt8500lcdfb framebuffer driver. Specific kernel versions are not enumerated in the provided data; affected systems are those running a kernel build that includes this driver and that have not yet incorporated the upstream patch that adds dma_free_coherent() to the error path.

Risk and Exploitability

No CVSS, EPSS, or KEV information is available, indicating the vulnerability is not currently exploited in the wild. Exploitation requires local or privileged access to trigger the driver’s error path, making the attack vector limited to systems that load the vt8500lcdfb driver and experience a frequent initialization failure. The overall risk is low but the flaw can lead to degraded performance or denial of service through resource exhaustion over time.

Generated by OpenCVE AI on May 6, 2026 at 14:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a release that contains the vt8500lcdfb fix for dma_free_coherent() in the error path
  • If running a custom or upstream kernel, apply the commit or patch that adds the missing dma_free_coherent() call to the error handling code
  • If a kernel upgrade cannot be performed immediately, disable or unload the vt8500lcdfb framebuffer driver via modprobe or by removing the module from the boot configuration to stop the memory leak until a patched kernel is available

Generated by OpenCVE AI on May 6, 2026 at 14:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 06 May 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401

Wed, 06 May 2026 12:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: fbdev: vt8500lcdfb: fix missing dma_free_coherent() fbi->fb.screen_buffer is allocated with dma_alloc_coherent() but is not freed if the error path is reached.
Title fbdev: vt8500lcdfb: fix missing dma_free_coherent()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-06T11:28:08.226Z

Reserved: 2026-05-01T14:12:55.992Z

Link: CVE-2026-43202

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-06T12:16:39.347

Modified: 2026-05-06T13:07:51.607

Link: CVE-2026-43202

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-06T17:00:05Z

Weaknesses