Executive brief
A vulnerability in the Rockchip camera interface driver within the Linux kernel could allow a local user to crash the system. The issue occurs when the system attempts to start a video stream without a properly connected device, leading to a kernel crash. This primarily impacts the availability of devices using Rockchip hardware, such as certain embedded systems or media players.
Technical details
A NULL pointer dereference exists in the Rockchip Camera Interface (rkcif) driver within the Linux kernel's media subsystem. The vulnerability is caused by missing MEDIA_PAD_FL_MUST_CONNECT flags on media pads in rkcif-interface.c and rkcif-stream.c. When a user-space application attempts to enable a stream (via VIDIOC_STREAMON) without a valid connected device, the driver fails to validate the connection, leading to a NULL pointer dereference in rkcif_interface_enable_streams. This results in a kernel panic and local denial of service. The issue has been resolved by adding the mandatory connection flags to the affected pads.
Affected products
- Linux Linux Kernel Fixed in 8e3c751259dc2d1325838eff26f41032523c7b57 and 318142640590342bfec7aa06d0bdcd0ddbf953d0
Timeline
- 2026-01-29: other: Patch authored
- 2026-05-17: patched: Patch committed to stable tree
- 2026-05-28: disclosed: CVE published