Junglewise Threat Intelligence

CVE-2026-43256: Linux Kernel Qualcomm CAMSS out-of-bounds access in VFE ISR

CVE-2026-43256 · Severity: high · CVSS 7.8 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Qualcomm Camera Subsystem (CAMSS) driver. This component is responsible for managing camera hardware on devices using Qualcomm processors. An exploit could allow a local user to cause a system crash or potentially access sensitive memory, impacting the device's stability and data security.

Technical details

An out-of-bounds access vulnerability exists in the 'vfe_isr_reg_update' function within the Qualcomm CAMSS VFE driver (specifically in camss-vfe-480.c). The root cause is an incorrect loop bound in 'vfe_isr()', which uses 'MSM_VFE_IMAGE_MASTERS_NUM' (7) to iterate, while the 'vfe->line[]' array is capped at 'VFE_LINE_NUM_MAX' (4). When the loop index reaches 4, 5, or 6, the driver attempts to access memory outside the allocated array bounds. This is a local vulnerability (AV:L) that requires low privileges (PR:L) and no user interaction. It can result in a kernel oops, denial of service, or potentially information disclosure/privilege escalation. The fix involves separating the loops for output lines and write masters to ensure correct indexing.

Affected products

  • Linux Linux Kernel 5.18 to 6.1.167, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2025-12-29: other: Initial patch authored
  • 2026-01-13: other: Patch committed to mainline kernel
  • 2026-05-06: advisory: CVE published by kernel.org
  • 2026-05-11: other: NVD analysis and enrichment

References

Related threats