Executive brief
A vulnerability in the Linux kernel's camera sensor driver could allow a local user to crash the system. The issue occurs when the software performs a mathematical calculation without verifying that a specific hardware register value is non-zero. This could lead to a system hang or 'kernel panic,' impacting the availability of the device.
Technical details
A division-by-zero vulnerability (CWE-369) exists in the MIPI CCS (Camera Control Interface) driver within the Linux kernel's media subsystem. The flaw is located in the `ccs_set_compose_scaler` function in `drivers/media/i2c/ccs/ccs-core.c`, where the code calculates the maximum scaler configuration (M) by dividing by the `MIN_X_OUTPUT_SIZE` limit register value without first validating that the value is non-zero. A local attacker with sufficient privileges to interact with the media subsystem could trigger this condition, leading to a kernel oops or system crash (Denial of Service). Patches have been released across multiple stable kernel branches to ensure the divisor is at least 1.
Affected products
- Linux Linux Kernel 3.5 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-11-25: other: Patch authored
- 2026-05-06: advisory: CVE published by kernel.org
- 2026-05-11: other: NVD analysis completed
References
- https://git.kernel.org/stable/c/32a21ed2ad743fe2d12af48e627089b921a032c2
- https://git.kernel.org/stable/c/679f0b7b6a409750a25754c8833e268e5fdde742
- https://git.kernel.org/stable/c/8ca7df18e7a58a0e5b0ed9eaaa34e16fc5cb9680
- https://git.kernel.org/stable/c/9aae0f31d37a8facd25e37c0f0709ea08de83802
- https://git.kernel.org/stable/c/a8ff58cc8c7514c278ba0ea2c787d4bf9eeb355d
- https://git.kernel.org/stable/c/b6e0529c300e44153fc6f3b565e28163caf1f031
- https://git.kernel.org/stable/c/c9af1818387f5c6f543e2e02c40b3038eae86be8