CVE-2026-68203

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

media: vivid: fix cleanup bugs in vivid_init()

When platform_device_register() fails in vivid_init(), the embedded

struct device in vivid_pdev has already been initialized by

device_initialize(), but the failure path jumps to free_output_strings

without dropping the device reference for the current platform device:

vivid_init()

-> platform_device_register(&vivid_pdev)

-> device_initialize(&vivid_pdev.dev)

-> setup_pdev_dma_masks(&vivid_pdev)

-> platform_device_add(&vivid_pdev)

This leads to a reference leak when platform_device_register() fails.

Fix this by calling platform_device_put() before jumping to the common

cleanup path.

Also, the unreg_driver label incorrectly calls

platform_driver_register() instead of platform_driver_unregister(),

which breaks cleanup when workqueue creation fails after successful

driver registration. Fix that as well.

The reference leak was identified by a s

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References