Executive brief
A vulnerability in the Linux kernel's Qualcomm CCI (Camera Control Interface) driver can cause a system crash (NULL pointer dereference) when the driver is removed or the device is unbound. This occurs on hardware configurations where only one of the two available I2C masters is active. While this primarily affects system stability, it could be used by a local attacker to cause a denial-of-service.
Technical details
A NULL pointer dereference exists in drivers/i2c/busses/i2c-qcom-cci.c within the cci_remove() function. The Qualcomm CCI controller typically provides two I2C masters; however, if a board only initializes one master, the driver's removal sequence incorrectly attempts to call cci_halt() for both. Because the completion structures are only initialized for enabled masters, calling cci_halt() on an uninitialized master triggers a NULL pointer dereference during wait_for_completion_timeout(). This can be triggered by a local user with sufficient privileges to unbind the driver or remove the module (e.g., rmmod i2c-qcom-cci). The issue has been resolved by moving the cci_halt() call inside the conditional block that checks if the master was actually initialized.
Affected products
- Linux Linux Kernel v5.8 to v6.9.x
Timeline
- 2026-05-16: patched: Initial fix authored by Vladimir Zapolskiy
- 2026-07-01: disclosed: CVE published in NVD
References
- https://git.kernel.org/stable/c/4cd206c1d57a9370d5219f7b1fc45169d7bdf951
- https://git.kernel.org/stable/c/4d2b4a9cda6837e5ee1de1290f2e773a713b71e9
- https://git.kernel.org/stable/c/7107627b8b35015027201e7a095a3f6e30b4a46f
- https://git.kernel.org/stable/c/729ac5a4b966aac42e08a94dea966f4429008548
- https://git.kernel.org/stable/c/8ce7ff721a5e9d06d53ef65d01c89fce6d26d6ff
- https://git.kernel.org/stable/c/a162a260c8c4db7501c65220e76913e8e351f823
- https://git.kernel.org/stable/c/a50b8adb9cdb9a495b0b45583956897b7411ed7a