CVE-2026-68221

A flaw was found in the Linux kernel's Nuvoton NPCM video driver. The npcm_video_probe() function allocates memory that is not properly freed on error paths or during device removal, leading to memory leaks. Additionally, when npcm_video_setup_video() fails, associated reserved memory is not released. These issues can lead to resource exhaustion, potentially resulting in a Denial of Service (DoS) for the system.

This issue affects systems using the Nuvoton NPCM video driver on BMC/embedded platforms. Probe error paths and remove() fail to free npcm_video allocations and reserved memory associations, leaking resources on each failed probe or unbind. Systems without NPCM video hardware are not affected.

To mitigate this issue, prevent the npcm-video module from loading. See https://access.redhat.com/solutions/41278 for instructions.