Executive brief
A vulnerability was identified in the Linux kernel's driver for NXP SAA7164 media controllers, which are used for video capture. The driver failed to check if memory mapping operations were successful during device setup, which could lead to a system crash (null pointer dereference) if the hardware fails to initialize correctly. This issue primarily affects system stability and availability.
Technical details
A vulnerability in the saa7164_dev_setup() function of the Linux kernel's media driver for SAA7164 PCI devices stems from a failure to validate the return values of ioremap() (specifically pci_ioremap_bar) for BAR0 and BAR2. If these memory mapping operations fail, the driver continues execution using null pointers for MMIO access, leading to a kernel oops/null pointer dereference. The fix introduces proper error handling that releases allocated PCI memory regions, removes the device from the global list, and decrements the device count upon failure. This is a local vulnerability requiring the presence of the affected hardware or the ability to trigger driver initialization.
Affected products
- Linux Linux kernel All versions prior to the May 2026 patches
Timeline
- 2026-03-16: other: Patch authored by Wang Jun
- 2026-05-28: disclosed: CVE published to NVD
- 2026-05-17: patched: Patch committed to stable kernel trees
References
- https://git.kernel.org/stable/c/3ce8f3057c51bb0a66aa3fab0862be74e9f88684
- https://git.kernel.org/stable/c/6047dc542fa404b5c187cc2c7906aaaaec6d11ed
- https://git.kernel.org/stable/c/6c22a6d8e4c1507bba504aeebe80476144a373eb
- https://git.kernel.org/stable/c/a9b83f46e52cf1239d780920d1a7a3e415f7b5d9
- https://git.kernel.org/stable/c/d51c60a498e83c9a79884c8e420f97e3885c9583