CVE-2026-68215 media: radio-si476x: Unregister v4l2_device on probe failure
A missing unregister call in the si476x radio driver probe error path leaves a dangling reference, potentially causing memory corruption or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68215?
CVE-2026-68215 is a memory corruption vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: radio-si476x: Unregister v4l2_device on probe failure
si476x_radio_probe() registers radio->v4l2dev before allocating the V4L2 controls and before registering the video device. If any of those later steps fails, probe returns through the exit label after freeing only the control handler.
A failed probe does not call si476x_radio_remove(), so the v4l2_device_unregister() there is not reached. This leaves the parent device reference taken by v4l2_device_register() behind on the error path.
Unregister the V4L2 device in the probe error path after freeing the controls.
Which versions are affected by CVE-2026-68215?
How do I fix CVE-2026-68215?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68215 being exploited?
There is no known exploitation of CVE-2026-68215 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68215, DEBIAN-CVE-2026-68215, GHSA-gwv8-m63h-cvjc, UBUNTU-CVE-2026-68215.