Skip to main content

Linux Kernel EUVDEUVD-2026-32757

| CVE-2026-46239 MEDIUM
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-vp8m-hhj2-6fc6
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access to the V4L2 device node and low-privilege user required; no confidentiality or integrity impact, only availability loss via PM refcount exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 10, 2026 - 23:22 vuln.today
CVSS changed
Jun 10, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
MEDIUM 5.5
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl

Three control cases (AUTOGAIN, EXPOSURE_AUTO, ANALOGUE_GAIN) directly return without calling pm_runtime_put(), causing runtime PM reference count leaks.

Change these cases from 'return' to 'ret = ... break' pattern to ensure pm_runtime_put() is always called before function exit.

AnalysisAI

Runtime PM reference count leak in the Linux kernel's OmniVision OV5647 camera sensor driver (media/i2c/ov5647) causes availability loss for systems equipped with this camera hardware. The s_ctrl function's handling of three V4L2 controls - AUTOGAIN, EXPOSURE_AUTO, and ANALOGUE_GAIN - returns early without invoking pm_runtime_put(), allowing unpaired runtime PM get/put calls to accumulate. A local user with access to the camera device node can trigger this imbalance repeatedly, exhausting the PM reference count and preventing the device from entering low-power states, ultimately making it unavailable. No public exploit has been identified; EPSS is 0.02% (5th percentile) and this vulnerability does not appear in CISA KEV.

Technical ContextAI

The OmniVision OV5647 is a 5-megapixel CMOS image sensor widely used in Raspberry Pi camera modules and similar embedded platforms. Its Linux driver resides in drivers/media/i2c/ov5647.c and integrates with the V4L2 (Video4Linux2) subsystem and the kernel's runtime power management (runtime PM) framework. Runtime PM allows devices to be selectively suspended when idle; callers must bracket device usage with pm_runtime_get_*() and pm_runtime_put*() to maintain a reference count. The affected function, s_ctrl (set control), acquires a PM reference at entry via pm_runtime_get_sync() but three control handling cases (V4L2_CID_AUTOGAIN, V4L2_CID_EXPOSURE_AUTO, V4L2_CID_ANALOGUE_GAIN) used bare 'return' statements rather than breaking to the common exit path that calls pm_runtime_put(). This is a resource management bug (closest CWE mapping: CWE-772 - Missing Release of Resource after Effective Lifetime). The CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* confirms broad kernel scope, but the practical impact is limited to kernels with the ov5647 driver compiled in and hardware present. Note: the source tags this as 'Information Disclosure,' which is inconsistent with the CVE description and the CVSS vector (C:N); the actual impact is Availability only.

RemediationAI

Apply the vendor-released stable kernel patches: commit 6b03ecf75bda5900b8e661eb75656f631b598bc2 (targeting Linux 7.0.x stable, available at https://git.kernel.org/stable/c/6b03ecf75bda5900b8e661eb75656f631b598bc2) and commit f11ae9c04f8368a3b5a0280ef595198dace1c983 (available at https://git.kernel.org/stable/c/f11ae9c04f8368a3b5a0280ef595198dace1c983). Systems running Linux 7.0.9 or later, or 7.1-rc1 and later, include the fix. As a compensating control for unpatched systems, restricting access permissions on /dev/video* device nodes to trusted users or groups (e.g., via udev rules) limits who can invoke the affected V4L2 ioctls; the trade-off is reduced access for legitimate camera applications. Alternatively, blacklisting the ov5647 kernel module (via /etc/modprobe.d/) entirely removes the attack surface if camera functionality is not required, though this disables camera hardware.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-32757 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy