Executive brief
A vulnerability in the Linux kernel's media subsystem could allow a local user to cause a system crash. The issue occurs during the initialization of media devices (like cameras or video capture cards) when the system fails to properly handle errors while connecting different hardware components. This could lead to a denial-of-service condition, impacting the availability of the system.
Technical details
A vulnerability in the Linux kernel's V4L2 (Video for Linux 2) asynchronous framework (v4l2-async) stems from improper error handling logic in the v4l2_async_match_notify() function. Specifically, if a failure occurs after a match is found but before sub-notifier handling is complete, the system may attempt to dereference an uninitialized 'sd' (sub-device) field in the v4l2_async_unbind_subdev_one() function. Additionally, redundant list removals and incorrect unbinding sequences could lead to kernel instability. An attacker with local access could potentially trigger these error paths to cause a kernel NULL pointer dereference or memory corruption, resulting in a system crash (Denial of Service). The issue has been resolved by refactoring the error handling paths and ensuring proper field initialization before dereferencing.
Affected products
- Linux Linux kernel 6.6 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-03-04: patched
References
- https://git.kernel.org/stable/c/2de0a3c8148fc3dbea21981e6569f550b3626119
- https://git.kernel.org/stable/c/30aaed311f973f13ba13a0cd2dc0202f595fff48
- https://git.kernel.org/stable/c/461733d83e67ba7e3a5b750c0d203f738e01244f
- https://git.kernel.org/stable/c/7345d6d356336c448d6b9230ed8704f39679fd12
- https://git.kernel.org/stable/c/b02bcb378efa8af07827f49b3afcc5e825318c55