Executive brief
A vulnerability was identified in the Linux kernel's Intel IPU6 camera driver. This issue occurs during specific error-handling scenarios when the system is initializing the hardware. If triggered, it could lead to a system crash (kernel panic), potentially impacting the availability of the device or the entire operating system.
Technical details
A vulnerability exists in the Intel IPU6 PCI device driver (drivers/media/pci/intel/ipu6/ipu6.c) within the ipu6_pci_probe() function. During an error handling path, the code fails to correctly validate the 'isp->psys' pointer. Specifically, the code checks if the pointer is non-NULL but fails to account for the possibility that it contains an error code (ERR_PTR). This results in a dereference of an invalid memory address when the error path is triggered. The fix introduces the IS_ERR_OR_NULL macro to properly validate the pointer before use. This is primarily a local denial-of-service (system crash) risk.
Affected products
- Linux Linux Kernel Intel IPU6 PCI device driver
Timeline
- 2026-03-11: patched: Initial patch committed to mainline kernel.
- 2026-06-08: disclosed: CVE published.