CVE-2026-43312: media: i2c: ov5647: Initialize subdev before controls
In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov5647: Initialize subdev before controls
In ov5647initcontrols() we call v4l2getsubdevdata, but it is initialized by v4l2i2csubdevinit() in the probe, which currently happens after initcontrols(). This can result in a segfault if the error condition is hit, and we try to access i2cclient, so fix the order.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43312?
CVE-2026-43312 has a medium severity level due to improper initialization of controls in the ov5647 driver.
How do I fix CVE-2026-43312?
To fix CVE-2026-43312, update your Linux kernel to a version that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2026-43312?
CVE-2026-43312 affects Linux kernel versions between 5.12 and 6.19.6.
What components are impacted by CVE-2026-43312?
CVE-2026-43312 impacts the ov5647 driver used in media I2C subsystems within the Linux kernel.
Is CVE-2026-43312 related to any specific hardware?
Yes, CVE-2026-43312 specifically affects the ov5647 image sensor driver in the Linux kernel.