CVE-2026-43312: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43312 Overview

CVE-2026-43312 is a kernel vulnerability in the Linux ov5647 camera sensor driver located at drivers/media/i2c/ov5647.c. The flaw originates from an incorrect initialization order in the driver probe routine. The function ov5647_init_controls() invokes v4l2_get_subdevdata() before the subdev is initialized by v4l2_i2c_subdev_init(). When the error path triggers and the driver attempts to dereference the i2c_client pointer, a NULL pointer dereference occurs, producing a kernel segfault. The issue affects multiple supported Linux kernel branches and impacts systems using the OmniVision OV5647 image sensor, such as Raspberry Pi camera modules.

Critical Impact

A local user able to trigger the driver error condition can cause a kernel-level denial of service through a NULL pointer dereference in the V4L2 media subsystem.

Affected Products

• Linux Kernel — multiple stable branches with the ov5647 driver present
• Systems using the OmniVision OV5647 I2C camera sensor (e.g., Raspberry Pi camera modules)
• Embedded Linux distributions shipping vulnerable media subsystem builds

Discovery Timeline

• 2026-05-08 - CVE-2026-43312 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43312

Vulnerability Analysis

The vulnerability resides in the ov5647 V4L2 sub-device driver, which handles the OmniVision OV5647 CMOS image sensor over the I2C bus. During device probe, the driver calls ov5647_init_controls() to register V4L2 controls. Inside this function, v4l2_get_subdevdata() is used to retrieve the associated i2c_client pointer.

The problem is one of ordering. The subdev is not yet bound to its private data because v4l2_i2c_subdev_init() runs later in the probe path. When init_controls() enters its error handling branch and attempts to use the i2c_client pointer for logging or cleanup, the dereference operates on uninitialized state and triggers a kernel oops.

This condition is classified as a Null Pointer Dereference [CWE-476-class] denial of service. Successful triggering requires local access and the ability to load or interact with the affected driver, but the result is a kernel crash impacting availability.

Root Cause

The root cause is an incorrect sequence in the driver probe routine. ov5647_init_controls() depends on subdev private data that has not yet been populated by v4l2_i2c_subdev_init(). The fix reorders these calls so the subdev is initialized before any control registration logic runs.

Attack Vector

Exploitation requires local, low-privileged access to a system with the ov5647 driver loaded and the corresponding hardware path exercised. There is no network attack surface. The impact is limited to availability, with no confidentiality or integrity loss. No public proof of concept is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified exploit code is available for this vulnerability.
// The fix reorders v4l2_i2c_subdev_init() to run before ov5647_init_controls()
// so that v4l2_get_subdevdata() returns a valid i2c_client pointer
// even when the controls initialization error path executes.

Detection Methods for CVE-2026-43312

Indicators of Compromise

• Kernel oops or panic messages referencing ov5647_init_controls or v4l2_get_subdevdata in dmesg or /var/log/kern.log.
• Repeated probe failures of the ov5647 driver during boot or hot-plug events.
• Unexpected camera subsystem unavailability on devices using the OV5647 sensor.

Detection Strategies

• Inventory running kernels with uname -r and compare against the patched stable branches listed in the kernel.org commits.
• Audit loaded modules with lsmod | grep ov5647 to identify exposed systems.
• Correlate kernel crash telemetry with module load events to spot repeated NULL pointer dereferences in the V4L2 path.

Monitoring Recommendations

• Forward kernel ring buffer logs to a centralized logging or SIEM platform for alerting on BUG: and Oops: entries tied to media drivers.
• Track kernel package versions across fleet endpoints and flag hosts pinned to vulnerable branches.
• Monitor system uptime regressions on embedded Linux devices that rely on camera peripherals.

How to Mitigate CVE-2026-43312

Immediate Actions Required

• Update affected Linux systems to a stable kernel release that includes the upstream fix from the referenced kernel.org commits.
• Restrict local access to systems running unpatched kernels with the ov5647 driver loaded.
• For embedded fleets, schedule firmware or image updates that incorporate the patched kernel branch.

Patch Information

The upstream fix reorders v4l2_i2c_subdev_init() to run before ov5647_init_controls() in the driver probe path, ensuring v4l2_get_subdevdata() returns a valid i2c_client even on the error path. Patches are available across multiple stable branches: kernel.org commit 2dedda9, kernel.org commit 59e372a, kernel.org commit 8ecb21c, kernel.org commit cabd025, kernel.org commit eee13cb, kernel.org commit f2a1998, and kernel.org commit fb69e48.

Workarounds

• Blacklist the ov5647 module on systems that do not require OV5647 camera functionality until the kernel can be patched.
• Limit local user access on multi-user systems where the driver must remain loaded.
• Apply distribution-provided kernel updates as soon as they become available rather than relying on workarounds.

# Blacklist the ov5647 module if camera functionality is not required
echo "blacklist ov5647" | sudo tee /etc/modprobe.d/blacklist-ov5647.conf
sudo update-initramfs -u
sudo reboot

# Verify the module is no longer loaded
lsmod | grep ov5647