CVE-2020-36777: media: dvbdev: Fix memory leak in dvb_media_device_free()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-27 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: Fix memory leak in dvb_media_device_free() dvb_media_device_free() is leaking memory. Free `dvbdev->adapter->conn` before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required."

Affected products

Linux kernel: from 4.5.0 before 4.9.269; from 4.10.0 before 4.14.233; from 4.15.0 before 4.19.191; from 4.20.0 before 5.4.118; from 5.5.0 before 5.10.36; from 5.11.0 before 5.11.20 — fixed in 4.14.233, 4.19.191, 4.9.269, 5.10.36, 5.11.20, 5.12.3

How to fix

Upgrade to a fixed version: Linux kernel 4.14.233, 4.19.191, 4.9.269, 5.10.36. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36777 or the next vulnerability affects your stack