Skip to main content

Linux Kernel EUVDEUVD-2026-32757

| CVE-2026-46239 MEDIUM
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-vp8m-hhj2-6fc6
Linux Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access to the V4L2 device node and low-privilege user required; no confidentiality or integrity impact, only availability loss via PM refcount exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 10, 2026 - 23:22 vuln.today
CVSS changed
Jun 10, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
MEDIUM 5.5
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl

Three control cases (AUTOGAIN, EXPOSURE_AUTO, ANALOGUE_GAIN) directly return without calling pm_runtime_put(), causing runtime PM reference count leaks.

Change these cases from 'return' to 'ret = ... break' pattern to ensure pm_runtime_put() is always called before function exit.

AnalysisAI

Runtime PM reference count leak in the Linux kernel's OmniVision OV5647 camera sensor driver (media/i2c/ov5647) causes availability loss for systems equipped with this camera hardware. The s_ctrl function's handling of three V4L2 controls - AUTOGAIN, EXPOSURE_AUTO, and ANALOGUE_GAIN - returns early without invoking pm_runtime_put(), allowing unpaired runtime PM get/put calls to accumulate. A local user with access to the camera device node can trigger this imbalance repeatedly, exhausting the PM reference count and preventing the device from entering low-power states, ultimately making it unavailable. No public exploit has been identified; EPSS is 0.02% (5th percentile) and this vulnerability does not appear in CISA KEV.

Technical ContextAI

The OmniVision OV5647 is a 5-megapixel CMOS image sensor widely used in Raspberry Pi camera modules and similar embedded platforms. Its Linux driver resides in drivers/media/i2c/ov5647.c and integrates with the V4L2 (Video4Linux2) subsystem and the kernel's runtime power management (runtime PM) framework. Runtime PM allows devices to be selectively suspended when idle; callers must bracket device usage with pm_runtime_get_*() and pm_runtime_put*() to maintain a reference count. The affected function, s_ctrl (set control), acquires a PM reference at entry via pm_runtime_get_sync() but three control handling cases (V4L2_CID_AUTOGAIN, V4L2_CID_EXPOSURE_AUTO, V4L2_CID_ANALOGUE_GAIN) used bare 'return' statements rather than breaking to the common exit path that calls pm_runtime_put(). This is a resource management bug (closest CWE mapping: CWE-772 - Missing Release of Resource after Effective Lifetime). The CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* confirms broad kernel scope, but the practical impact is limited to kernels with the ov5647 driver compiled in and hardware present. Note: the source tags this as 'Information Disclosure,' which is inconsistent with the CVE description and the CVSS vector (C:N); the actual impact is Availability only.

RemediationAI

Apply the vendor-released stable kernel patches: commit 6b03ecf75bda5900b8e661eb75656f631b598bc2 (targeting Linux 7.0.x stable, available at https://git.kernel.org/stable/c/6b03ecf75bda5900b8e661eb75656f631b598bc2) and commit f11ae9c04f8368a3b5a0280ef595198dace1c983 (available at https://git.kernel.org/stable/c/f11ae9c04f8368a3b5a0280ef595198dace1c983). Systems running Linux 7.0.9 or later, or 7.1-rc1 and later, include the fix. As a compensating control for unpatched systems, restricting access permissions on /dev/video* device nodes to trusted users or groups (e.g., via udev rules) limits who can invoke the affected V4L2 ioctls; the trade-off is reduced access for legitimate camera applications. Alternatively, blacklisting the ov5647 kernel module (via /etc/modprobe.d/) entirely removes the attack surface if camera functionality is not required, though this disables camera hardware.

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-32757 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy