Executive brief
A vulnerability in the Linux kernel's Renesas VSP1 video processing driver can cause a system crash when the driver module is unloaded. This occurs specifically on 4th generation hardware due to an error in how the system cleans up resources. While this primarily affects system stability during maintenance or driver updates, it could lead to a denial-of-service condition.
Technical details
A NULL pointer dereference exists in the Renesas VSP1 driver (drivers/media/platform/renesas/vsp1/vsp1_drv.c) during module unload on Gen 4 hardware. The vulnerability is caused by the cleanup routine incorrectly calling vsp1_drm_cleanup() instead of vsp1_vspx_cleanup() for VSPX Gen 4 models. An attacker with sufficient privileges to unload kernel modules could trigger this crash, leading to a denial-of-service. The fix involves implementing a conditional check for the IP version (VI6_IP_VERSION_MODEL_VSPX_GEN4) to ensure the correct cleanup function is invoked.
Affected products
- Linux Linux Kernel vsp1 driver versions prior to fix
Timeline
- 2026-01-15: other: Patch authored
- 2026-06-08: disclosed: CVE published