CVE-2026-43312 Linux Kernel ov5647驱动初始化错误漏洞

/* * PoC Concept for CVE-2026-43312 * This vulnerability is triggered during the driver initialization (probe). * It requires a system with the vulnerable ov5647 driver hardware. * * The crash occurs when ov5647_init_controls() is called before * v4l2_i2c_subdev_init(), and an error path is hit. */ #include <linux/module.h> #include <linux/i2c.h> // Simulating the vulnerable flow static int simulate_vulnerable_probe(struct i2c_client *client) { struct v4l2_subdev *sd; // VULNERABILITY: init_controls called before subdev init // Inside ov5647_init_controls, v4l2_get_subdevdata(sd) returns NULL // because sd is not yet initialized by v4l2_i2c_subdev_init. int ret = ov5647_init_controls(sd); if (ret < 0) { // If ret is error, cleanup code tries to access i2c_client // via v4l2_get_subdevdata(sd), which is NULL. // This causes a Null Pointer Dereference -> Kernel Panic. goto error_handler; } // Correct initialization should happen here, but it's too late. v4l2_i2c_subdev_init(sd, client, &ov5647_subdev_ops); return 0; error_handler: // Crash happens here accessing uninitialized data return ret; }