Executive brief
The Linux kernel's video4linux (v4l2) async media framework can crash with a NULL pointer dereference when ancillary media link creation fails during device binding. A system with cameras or video devices using v4l2 async drivers could experience kernel panics or service disruption if this error path is triggered during device initialization.
Technical details
A use-after-free / NULL pointer dereference vulnerability exists in v4l2_async_match_notify() in the v4l2-async driver. When ancillary media link creation fails before the asc_subdev_entry is added to the sd->asc_list, the error handler attempts to call list_del() on an unlinked list entry that still has NULL next/prev pointers. This causes a NULL pointer dereference instead of properly returning the original link creation error. The fix removes the erroneous list_del() call from the error path, as the list insertion has not yet occurred at that point and only the bound callback and sub-device registration need to be rolled back.
Affected products
- Linux Linux kernel multiple kernel versions (v5.x through v7.x based on stable tree references)
Timeline
- 2026-09-16: disclosed
- 2026-08-10: patched: Upstream fix committed by Sakari Ailus