Executive brief
A vulnerability was identified in the Linux kernel's solo6x10 media driver, which handles certain video hardware. Under specific conditions, the system could experience undefined behavior or crashes due to improper handling of internal chip identifiers. This could lead to a denial of service or unpredictable system instability for users with local access to the machine.
Technical details
A vulnerability exists in the solo6x10 driver within the Linux kernel's media subsystem. The issue stems from a lack of bounds checking on 'chip_id' and the use of signed integers in bitwise shift operations within the 'is_tw286x' macro. When compiled with Clang and UBSAN enabled, the compiler may identify potential undefined behavior (shifting a signed 32-bit integer beyond its width) and elide critical function logic during optimization. An attacker with local access could potentially trigger this out-of-bounds condition via the 'tw28_set_ctrl_val' or 'tw28_get_ctrl_val' functions, leading to kernel instability or a denial of service. The fix introduces explicit bounds checking for 'chip_num' and uses unsigned literals for bit shifts.
Affected products
- Linux Linux Kernel solo6x10 driver
Timeline
- 2025-12-11: other: Patch authored by Kees Cook
- 2026-05-08: advisory: CVE-2026-43316 published
References
- https://git.kernel.org/stable/c/0b3dadada2417782a63ce32dae05bafe1c949e3f
- https://git.kernel.org/stable/c/0fdf6323c35a134f206dcad5babb4ff488552076
- https://git.kernel.org/stable/c/33af366211ee78e3b074ff44a16121e537e86826
- https://git.kernel.org/stable/c/4d6db0c6bbbfd8d7bbdbf7ab6a9c003752abf116
- https://git.kernel.org/stable/c/5849ae68d7b8b6ad55cc1bf0d227dd2ae6362528
- https://git.kernel.org/stable/c/603e3859393ee2ce91393b7d05e6e56e4b66e5cd
- https://git.kernel.org/stable/c/c327192ca26670cf6e588c1eeda66cd2fa97630e