CVE-2026-46222: media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads
In the Linux kernel, the following vulnerability has been resolved:
media: rockchip: rkcif: Add missing MUSTCONNECT flag to pads
The pads missed checks for connected devices which may a null dereference when the stream is enabled.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 pc : rkcifinterfaceenablestreams+0x48/0xf0 lr : rkcifinterfaceenablestreams+0x44/0xf0 Call trace: rkcifinterfaceenablestreams+0x48/0xf0 v4l2subdevenablestreams+0x26c/0x3f0 rkcifstreamstartstreaming+0x140/0x278 vb2startstreaming+0x74/0x188 vb2corestreamon+0xe0/0x1d8 vb2ioctlstreamon+0x60/0xa8 v4lstreamon+0x2c/0x40 videodoioctl+0x34c/0x400 videousercopy+0x2d0/0x800 videoioctl2+0x20/0x60 v4l2ioctl+0x48/0x78
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add the missing MUST_CONNECT flag to the rkcif pads in the media/rockchip driver source so pads are checked for connected devices. Rebuild and deploy the kernel containing this change to ensure streams do not trigger a NULL pointer dereference when enabled.
Linux kernel (media/rockchip rkcif) MUST_CONNECT flag on pads = enabled/added
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46222?
CVE-2026-46222 has a risk score of 34, indicating a moderate severity level.
How do I fix CVE-2026-46222?
To fix CVE-2026-46222, update your Linux kernel to the latest version that resolves this vulnerability.
What are the potential impacts of CVE-2026-46222?
CVE-2026-46222 can lead to a null pointer dereference, resulting in a system crash when the stream is enabled.
Which software is affected by CVE-2026-46222?
CVE-2026-46222 affects the Linux kernel, specifically the rkcif driver for Rockchip media-related functions.
What type of vulnerability is CVE-2026-46222 classified as?
CVE-2026-46222 is classified as a Null Pointer Dereference vulnerability.