CVE-2026-43189: media: v4l2-async: Fix error handling on steps after finding a match
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-async: Fix error handling on steps after finding a match
Once an async connection is found to be matching with an fwnode, a sub-device may be registered (in case it wasn't already), its bound operation is called, ancillary links are created, the async connection is added to the sub-device's list of connections and removed from the global waiting connection list. Further on, the sub-device's possible own notifier is searched for possible additional matches.
Fix these specific issues:
- If v4l2asyncmatchnotify() failed before the sub-notifier handling, the async connection was unbound and its entry removed from the sub-device's async connection list. The latter part was also done in v4l2asyncmatchnotify().
- The async connection's sd field was only set after creating ancillary links in v4l2asyncmatchnotify(). It was however dereferenced in v4l2asyncunbindsubdevone(), which was called on error path of v4l2asyncmatchnotify() failure.
Affected Software
Remediation
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the likely security impact?
The reported impact is availability only: successful exploitation may cause a high availability impact. The CVSS vector reports no confidentiality or integrity impact.
What code path is affected?
The issue is in Linux kernel media v4l2-async error handling after an asynchronous connection matches an fwnode. It involves failure handling around sub-device binding, ancillary-link creation, and sub-notifier matching.
What should be done to remediate it?
Apply an available Linux kernel patch. The provided references identify stable kernel commits for the fix.