Executive brief
A security vulnerability was identified in the Intel Atom Image Signal Processor (atomisp) driver within the Linux kernel. This driver is responsible for managing camera hardware on certain Intel-based devices. The vulnerability involves 'private IOCTLs,' which are specialized commands that could potentially be misused to cause system instability or unauthorized access. As a precaution, these commands have been disabled to protect users from potential exploits.
Technical details
The vulnerability exists within the atomisp driver's IOCTL handling logic in 'drivers/staging/media/atomisp/pci/atomisp_ioctl.c'. The private IOCTL handlers (vidioc_default) were deemed unsafe, potentially allowing for undefined behavior or security boundary violations when processed. The fix involves explicitly disallowing all private IOCTL commands by returning -EINVAL at the beginning of the 'atomisp_vidioc_default' function. This is a proactive mitigation in the staging driver to prevent exploitation of potentially buggy IOCTL code paths. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel atomisp driver in staging/media
Timeline
- 2026-02-26: patched: Initial fix authored by Sakari Ailus
- 2026-05-28: disclosed: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c
- https://git.kernel.org/stable/c/6850a439f8d23d4979624f1d6880d3118d473a28
- https://git.kernel.org/stable/c/6f1ce75a75c65061e7a720c3d0ee5f8adab7a2d3
- https://git.kernel.org/stable/c/8c7a281a99224a5b9af99c4dcd98d68eea75926c
- https://git.kernel.org/stable/c/c7848b67ef10f581114b6a2f52b160fc20eb52c9