CVE-2023-54208media: ov5675: Fix memleak in ov5675_init_controls()
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 89% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: media: ov5675: Fix memleak in ov5675_init_controls() There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock device: AssertionError: unreferenced object 0xffff888107362160 (size 16): comm "python3", pid 277, jiffies 4294832798 (age 20.722s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000abe7d67c>] __kmalloc_node+0x44/0x1b0 [<000000008a725aac>] kvmalloc_node+0x34/0x180 [<000000009a53cd11>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] [<0000000055b46db0>] ov5675_probe+0x38b/0x897 [ov5675] [<00000000153d886c>] i2c_device_probe+0x28d/0x680 [<000000004afb7e8f>] really_probe+0x17c/0x3f0 [<00000000ff2f18e4>] __driver_probe_device+0xe3/0x170 [<000000000a001029>] driver_probe_device+0x49/0x120 [<00000000e39743c7>] __device_attach_driver+0xf7/0x150 [<00000000d32fd070>] bus_for_each_drv+0x114/0x180 [<000000009083ac41>] __device_attach+0x1e5/0x2d0 [<0000000015b4a830>] bus_probe_device+0x126/0x140 [<000000007813deaf>] device_add+0x810/0x1130 [<000000007becb867>] i2c_new_client_device+0x386/0x540 [<000000007f9cf4b4>] of_i2c_register_device+0xf1/0x110 [<00000000ebfdd032>] of_i2c_notify+0xfc/0x1f0 ov5675_init_controls() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak.
Timeline
ID reserved
By Linux
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Deferred.
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected bf27502b1f3bf8095bf81736e506d354a2ce9ec4 – < 086a80b842bcb621d6c4eedad20683f1f674d0c2
- affected bf27502b1f3bf8095bf81736e506d354a2ce9ec4 – < bcae9115a163198dce9126aa8bedc1c007ec30ed
- affected bf27502b1f3bf8095bf81736e506d354a2ce9ec4 – < ba54908ae8225d58f1830edb394d4153bcb7d0aa
- affected bf27502b1f3bf8095bf81736e506d354a2ce9ec4 – < 49b849824b9862f177fc77fc92ef95ec54566ecf
- affected bf27502b1f3bf8095bf81736e506d354a2ce9ec4 – < 7a36a6be694df87d019663863b922913947b42af
- affected bf27502b1f3bf8095bf81736e506d354a2ce9ec4 – < dd74ed6c213003533e3abf4c204374ef01d86978
- affected 5.4
- unaffected < 5.4
- unaffected 5.4.235 – ≤ 5.4.*
- unaffected 5.10.173 – ≤ 5.10.*
- unaffected 5.15.99 – ≤ 5.15.*
- unaffected 6.1.16 – ≤ 6.1.*
- unaffected 6.2.3 – ≤ 6.2.*
- unaffected 6.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/086a80b842bcb621d6c4eedad20683f1f674d0c2 (opens in a new tab)
- https://git.kernel.org/stable/c/bcae9115a163198dce9126aa8bedc1c007ec30ed (opens in a new tab)
- https://git.kernel.org/stable/c/ba54908ae8225d58f1830edb394d4153bcb7d0aa (opens in a new tab)
- https://git.kernel.org/stable/c/49b849824b9862f177fc77fc92ef95ec54566ecf (opens in a new tab)
- https://git.kernel.org/stable/c/7a36a6be694df87d019663863b922913947b42af (opens in a new tab)
- https://git.kernel.org/stable/c/dd74ed6c213003533e3abf4c204374ef01d86978 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2023-60433 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2023-54208)Record last updated .