Skip to main content

Linux Kernel EUVDEUVD-2026-27798

| CVE-2026-43235 MEDIUM
2026-05-06 Linux GHSA-9g4v-54hx-cw68
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local user triggers null callback via V4L2 API on SM8750 hardware; no confidentiality or integrity impact, purely availability.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:56 vuln.today
CVSS changed
May 12, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: iris: Add missing platform data entries for SM8750

Two platform-data fields for SM8750 were missed:

  • get_vpu_buffer_size = iris_vpu33_buf_size

Without this, the driver fails to allocate the required internal buffers, leading to basic decode/encode failures during session bring-up.

  • max_core_mbps = ((7680 * 4320) / 256) * 60

Without this capability exposed, capability checks are incomplete and v4l2-compliance for encoder fails.

AnalysisAI

Availability failure in the Linux kernel's iris media driver for Qualcomm SM8750 (Snapdragon 8 Elite) causes video codec sessions to crash during bring-up due to two missing platform data entries. The absent get_vpu_buffer_size field prevents internal VPU buffer allocation, while the missing max_core_mbps entry causes incomplete capability checks and v4l2-compliance failures for the encoder. No public exploit exists and EPSS is 0.02% (4th percentile), consistent with the niche hardware dependency; this is a functional defect with availability impact rather than a traditional exploitable security weakness.

Technical ContextAI

The iris driver is the Linux kernel's Video Processing Unit (VPU) codec driver for Qualcomm SoCs, integrated into the V4L2 (Video4Linux2) subsystem. Platform-specific behavior is gated by a data table that maps SoC variants to callbacks and capabilities. For the SM8750 (Snapdragon 8 Elite), two entries were omitted from this table: get_vpu_buffer_size (which should reference iris_vpu33_buf_size to size internal codec buffers) and max_core_mbps (which should be set to the 8K@60fps value of ((7680x4320)/256)x60 to correctly expose encoder capacity). Without the buffer-size callback, session initialization fails at the buffer allocation phase; without the MBPS cap, encoder compliance checks against the V4L2 standard fail. The CPE string cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* identifies the Linux kernel broadly, but the defect is scoped entirely to SM8750-equipped systems. No formal CWE is assigned; CWE-665 (Improper Initialization) or CWE-909 (Missing Initialization of Resource) would be the most applicable root-cause classes.

RemediationAI

Upgrade to Linux 6.18.17 or Linux 6.19.6 (or later), which include the corrected SM8750 platform data entries per EUVD confirmed fix versions. For systems tracking the 7.0 development branch, apply commit c7b2105a1cad1737eb877cdb4865618927623dd4 available at https://git.kernel.org/stable/c/c7b2105a1cad1737eb877cdb4865618927623dd4. The 6.18.x fix is at https://git.kernel.org/stable/c/1aa5833f29b88c16e9ad49a1782927754f3af742 and the 6.19.x fix at https://git.kernel.org/stable/c/bbef55f414100853d5bcea56a41f8b171bac8fcb. For systems that cannot be patched immediately, suspending video encode and decode operations on SM8750 hardware (e.g., preventing V4L2 device node access via udev rules or DAC permissions) will prevent the availability impact, at the cost of disabling media codec functionality entirely on the affected SoC. Red Hat and SUSE distribution advisories should be tracked for enterprise-grade backported packages.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27798 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy