Executive brief
A vulnerability was identified in the Linux kernel's driver for the OmniVision OV5647 camera sensor. This component is commonly used in embedded systems and hardware like the Raspberry Pi to manage camera hardware. An exploit could cause the system to crash (segmentation fault) during hardware initialization, potentially leading to a denial-of-service where the camera or the entire system becomes unresponsive.
Technical details
A race condition or initialization order vulnerability exists in the ov5647 camera sensor driver (drivers/media/i2c/ov5647.c). The function ov5647_init_controls() attempts to access subdevice data via v4l2_get_subdevdata() before that data has been initialized by v4l2_i2c_subdev_init() in the probe function. If an error occurs during control initialization, the driver attempts to access the i2c_client through an uninitialized pointer, resulting in a kernel segmentation fault. This issue has been resolved by reordering the probe sequence to ensure the subdevice is initialized before the controls. The fix has been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel v4.14 and later
Timeline
- 2025-12-22: other: Patch authored
- 2026-01-14: patched: Mainline patch committed
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2dedda97a64e7735844609c6c77c0dd953d73833
- https://git.kernel.org/stable/c/59e372aa4cf60e2500eba7f978acdcb18bb49032
- https://git.kernel.org/stable/c/8ecb21c20387cc0c8aa00489a21ccc69f6b0f5d1
- https://git.kernel.org/stable/c/cabd025182cfed4a19b3aab57493e312d681e398
- https://git.kernel.org/stable/c/eee13cbccacb6d0a3120c126b8544030905b069d
- https://git.kernel.org/stable/c/f2a1998bc0053ebfe137f65081ed13afd9f34502
- https://git.kernel.org/stable/c/fb69e4842f5b463ff5f121d2ac7746014e3477ea