CVE-2026-68224: media: mali-c55: Fix possible ERR_PTR in enable_streams
In the Linux kernel, the following vulnerability has been resolved:
media: mali-c55: Fix possible ERRPTR in enablestreams
The mediapadremotepadunique() function returns either a valid pointer or an ERRPTR() on failure (-ENOTUNIQ if multiple links are enabled, -ENOLINK if no connected pad is found). The return value was assigned directly to isp->remotesrc and dereferenced in the next line without checking for errors, which could lead to an ERRPTR dereference.
Add proper error checking with ISERR() before dereferencing the pointer. Also set isp->remotesrc to NULL on error to maintain consistency with other error paths in the function.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the enable_streams() code path, before using the value returned by media_pad_remote_pad_unique(), check it with IS_ERR(). If it is an error pointer, set isp->remote_src to NULL and avoid the next-line dereference.
Linux kernel (media subsystem) media_pad_remote_pad_unique() error handling = Use IS_ERR() to check return value before dereferencing; set isp->remote_src = NULL on error to avoid ERR_PTR dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68224?
CVE-2026-68224 has a risk rating of 27, indicating it is considered a low to moderate vulnerability.
How do I fix CVE-2026-68224?
Fixing CVE-2026-68224 involves updating the Linux kernel to the latest patched version that resolves the 'enable_streams' issue.
What systems are affected by CVE-2026-68224?
CVE-2026-68224 affects systems running specific versions of the Linux kernel that utilize the mali-c55 media component.
What exploit capabilities does CVE-2026-68224 have?
CVE-2026-68224 may lead to unexpected behavior due to improper error handling in the media_pad_remote_pad_unique() function.
When was CVE-2026-68224 published?
CVE-2026-68224 was published on August 10, 2026.