Executive brief
The Linux kernel's video 4 Linux (V4L2) media framework can crash when certain USB camera devices are disconnected. The crash occurs when a driver uses an older registration method that bypasses the async subsystem, and the unregistration code fails to properly clean up the device. An attacker with physical access to disconnect a device could trigger a kernel crash and deny service.
Technical details
The vulnerability is a NULL pointer dereference (or logic error) in the v4l2-async subsystem's v4l2_async_unregister_subdev() function in drivers/media/v4l2-core/v4l2-async.c. When a sub-device (such as a tvp5150 video decoder) is registered using v4l2_async but its parent driver (such as em28xx) uses legacy registration, the asc_list remains empty. The original code checked if asc_list.next was non-NULL but then failed to call v4l2_device_unregister_subdev() when the list was empty, leading to improper cleanup and a crash on device disconnection. The fix adds an explicit check for an empty list and ensures proper unregistration in both code paths. No authentication or user interaction is required; physical device disconnection triggers the crash.
Affected products
- Linux Linux kernel v5.x through v6.x (specific versions affected by commit 28a1295795d8 and fixed in mainline; backported to stable branches)
Timeline
- 2026-06-29: other: Fix authored by Hans Verkuil
- 2026-07-14: patched: Merged to mainline by Mauro Carvalho Chehab
- 2026-09-14: patched: Backported to stable kernels by Greg Kroah-Hartman
- 2026-09-17: disclosed