Skip to main content

Linux Kernel EUVDEUVD-2026-27751

| CVE-2026-43189 MEDIUM
2026-05-06 Linux GHSA-qjw7-wgfm-9frq
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Local low-privilege access required; AC:H because exploitation only occurs on a specific error path during V4L2 async matching failure, not the normal success path.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:05 vuln.today
CVSS changed
May 11, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-async: Fix error handling on steps after finding a match

Once an async connection is found to be matching with an fwnode, a sub-device may be registered (in case it wasn't already), its bound operation is called, ancillary links are created, the async connection is added to the sub-device's list of connections and removed from the global waiting connection list. Further on, the sub-device's possible own notifier is searched for possible additional matches.

Fix these specific issues:

  • If v4l2_async_match_notify() failed before the sub-notifier handling,

the async connection was unbound and its entry removed from the sub-device's async connection list. The latter part was also done in v4l2_async_match_notify().

  • The async connection's sd field was only set after creating ancillary

links in v4l2_async_match_notify(). It was however dereferenced in v4l2_async_unbind_subdev_one(), which was called on error path of v4l2_async_match_notify() failure.

AnalysisAI

Error handling flaws in the Linux kernel's V4L2 async media subsystem allow a local low-privileged attacker to crash the kernel, causing a denial of service. Two bugs exist in the post-match processing path: an async connection is double-removed from the sub-device's connection list when v4l2_async_match_notify() fails mid-way, and the connection's sd pointer is dereferenced in the unbind error path before it is initialized - a NULL pointer dereference. No public exploit or active exploitation has been identified; EPSS at 0.02% (5th percentile) confirms very low current exploitation probability and this vulnerability is not listed in CISA KEV.

Technical ContextAI

The V4L2 (Video4Linux2) asynchronous subdevice registration framework manages binding of media hardware components - cameras, tuners, capture cards - to their notifiers via firmware node (fwnode) matching. During the match-and-bind sequence, v4l2_async_match_notify() orchestrates sub-device registration, bound callback invocation, ancillary link creation, connection list management, and sub-notifier matching. Two defects appear in the error handling: first, if v4l2_async_match_notify() fails before sub-notifier handling, the async connection's list entry is removed both inside the function and again by the caller, causing double-removal and potential list corruption. Second, the async connection's sd field is assigned only after ancillary links are created, but v4l2_async_unbind_subdev_one() dereferences that field on the failure path, resulting in a NULL or uninitialized pointer dereference. No formal CWE is assigned, but the patterns align with CWE-476 (NULL Pointer Dereference) and list-corruption patterns analogous to CWE-415. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched kernel version: 6.6.128, 6.12.75, 6.18.16, 6.19.6, or Linux 7.0. Upstream fix commits are available at https://git.kernel.org/stable/c/30aaed311f973f13ba13a0cd2dc0202f595fff48 (6.6.x), https://git.kernel.org/stable/c/b02bcb378efa8af07827f49b3afcc5e825318c55 (6.12.x), https://git.kernel.org/stable/c/2de0a3c8148fc3dbea21981e6569f550b3626119 (6.18.x), https://git.kernel.org/stable/c/7345d6d356336c448d6b9230ed8704f39679fd12 (6.19.x), and https://git.kernel.org/stable/c/461733d83e67ba7e3a5b750c0d203f738e01244f (7.0). Ubuntu users should apply USN-8492-1 (https://ubuntu.com/security/notices/USN-8492-1); Red Hat and SUSE users should consult their respective vendor security portals. If immediate patching is not feasible, removing local users from the 'video' group and restricting access to /dev/video* devices via udev rules reduces exposure, though this disables legitimate media access for those users. Systems without V4L2 media hardware or with the v4l2-async module unloaded require no action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27751 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy