Executive brief
A vulnerability was identified in the Linux kernel's video buffer management system. This component is responsible for handling video data streams, such as those from cameras. An issue in how memory is mapped could lead to system instability or unexpected behavior when applications interact with video hardware. The flaw has been resolved in recent kernel updates.
Technical details
A vulnerability in the Linux kernel's videobuf2 (vb2) subsystem was discovered where the vb2_dma_sg_mmap function failed to set the VM_DONTEXPAND and VM_DONTDUMP flags on Virtual Memory Areas (VMA). This inconsistency with other DMA allocators (like vb2_dma_contig) causes a kernel WARN_ON in drm_gem_mmap_obj() when mmap() is called on imported dma-bufs, specifically observed with the Apple ISP camera capture driver. An attacker with local access could potentially trigger this condition to cause system instability or bypass intended memory mapping restrictions. The fix involves explicitly setting these flags using vm_flags_set() in the affected component.
Affected products
- Linux Linux kernel 6.17.6+; fixed in 1a13602, 21fade5, 7254b31, b4cf916, feb1752
Timeline
- 2026-02-15: other: Patch authored
- 2026-05-17: patched: Patch committed to stable tree
- 2026-06-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1a1360264f699521e001e7739009ee3ee3c6a4f5
- https://git.kernel.org/stable/c/21fade52ab9fb13368a5709e60b0d9909197aeae
- https://git.kernel.org/stable/c/7254b31a13aaa0c2c0f9ffbc335b718656117ff4
- https://git.kernel.org/stable/c/b4cf91658a636618f1437beec971dec25dec28eb
- https://git.kernel.org/stable/c/feb17524aa4ec337749344be0db52b88663e25ab