Executive brief
A vulnerability in the Linux kernel's camera sensor driver could lead to power management issues. Specifically, certain camera control operations fail to properly release power references, which can prevent the system from entering low-power states or cause resource exhaustion over time. This primarily impacts system battery life and stability on devices using the OV5647 image sensor.
Technical details
A reference count leak exists in the ov5647_s_ctrl function within the drivers/media/i2c/ov5647.c driver. Three control cases (V4L2_CID_AUTOGAIN, V4L2_CID_EXPOSURE_AUTO, and V4L2_CID_ANALOGUE_GAIN) were implemented with direct return statements that bypassed the necessary pm_runtime_put() call. This results in a Runtime PM (Power Management) refcount leak every time these controls are accessed. Over time, this prevents the hardware from entering suspended states and can lead to kernel resource exhaustion. The fix replaces these direct returns with a break pattern to ensure the cleanup code is executed.
Affected products
- Linux Linux Kernel All versions prior to the fix in the ov5647 driver
Timeline
- 2026-02-25: other: Patch authored
- 2026-05-17: patched: Patch committed to stable tree
- 2026-05-28: advisory: CVE published by NVD