LiveActive security incident?Get immediate response
CVE Record

CVE-2020-36786: media: [next] staging: media: atomisp: fix memory leak of object flash

In the Linux kernel, the following vulnerability has been resolved: media: [next] staging: media: atomisp: fix memory leak of object flash In the case where the call to lm3554_platform_data_func returns an error there is a memory leak on the error return path of object flash. Fix this by adding an error return path that will free flash and rename labels fail2 to fail3 and fail1 to fail2.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2020-36786 is a Linux kernel memory-leak bug in the staging media atomisp driver. It occurs on an error path while handling flash-related driver data. Public data gives no CVSS score, no KEV listing, and no confirmed active exploitation, so business urgency depends on whether affected kernels and this driver are present.

Executive priority

Treat as a targeted kernel hygiene item, not an emergency, unless affected camera or embedded Linux systems are in production and remain unpatched. Lack of severity scoring and exploitation evidence lowers confidence in immediate business impact.

Technical view

The issue is in Linux staging media atomisp code. If lm3554_platform_data_func returns an error, the allocated flash object is not freed before returning. Kernel stable commits resolve this by adding an error path that frees flash and adjusts failure labels.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions or downstream backports containing the vulnerable atomisp staging media driver code. General server exposure is unclear from the source bundle; verify kernel version, vendor backports, and whether atomisp is built or loaded.

Exploitation context

The source bundle does not report active exploitation, public exploit availability, remote reachability, or privilege requirements. This is a kernel memory leak on a driver error path, so practical impact is not fully established by the cited sources.

Researcher notes

Key unknowns are reachability, trigger conditions, privilege requirements, and downstream patch status. The strongest evidence is the upstream/stable Linux fix description. Avoid assuming exploitability beyond a memory leak on the lm3554_platform_data_func error path.

Mitigation direction

  • Update to a kernel or vendor package containing the referenced stable fixes.
  • Check distribution advisories for backported fixes to affected kernel branches.
  • Prioritize systems where atomisp is built, loaded, or used.
  • Track this as unresolved if vendor fix status cannot be confirmed.

Validation and detection

  • Inventory Linux kernel versions against vendor security advisories and backport notes.
  • Check whether the atomisp staging media driver is built into deployed kernels.
  • Confirm installed kernel changelogs include the referenced memory-leak fix.
  • Document systems where driver presence or fix status cannot be verified.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-36786 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9289cdf399922a1bd801a8cd946a79581c00a380, 9289cdf399922a1bd801a8cd946a79581c00a380, 9289cdf399922a1bd801a8cd946a79581c00a380, 9289cdf399922a1bd801a8cd946a79581c00a380unaffected
LinuxLinux5.10, 0, 5.10.37, 5.11.21, 5.12.4, 5.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.