CVE-2026-43397 drm/bridge: samsung-dsim: Fix memory leak in error path
A memory leak in the Samsung DSIM driver error path allows attackers to cause a denial of service by exhausting kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43397?
CVE-2026-43397 is a medium-severity memory corruption vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: samsung-dsim: Fix memory leak in error path
In samsung_dsim_host_attach(), drm_bridge_add() is called to add the bridge. However, if samsung_dsim_register_te_irq() or pdata->host_ops->attach() fails afterwards, the function returns without removing the bridge, causing a memory leak.
Fix this by adding proper error handling with goto labels to ensure drm_bridge_remove() is called in all error paths. Also ensure that samsung_dsim_unregister_te_irq() is called if the attach operation fails after the TE IRQ has been registered.
samsung_dsim_unregister_te_irq() function is moved without changes to be before samsung_dsim_host_attach() to avoid forward declaration.
Weakness: CWE-401
Which versions are affected by CVE-2026-43397?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43397?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43397 being exploited?
There is no known exploitation of CVE-2026-43397 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43397, DEBIAN-CVE-2026-43397, GHSA-25rf-28xv-w8h2, ROOT-OS-UBUNTU-2404-CVE-2026-43397, UBUNTU-CVE-2026-43397.