PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46222 Linux CVE debrief

A null pointer dereference vulnerability exists in the Linux kernel's Rockchip Camera Interface (rkcif) driver. The issue stems from missing MUST_CONNECT flag validation on media pads, allowing stream enablement without verifying that connected devices are present. When streaming is initiated on an unconfigured interface, the driver dereferences a null pointer at offset 0x20 in rkcif_interface_enable_streams(), triggering an oops. The vulnerability is reachable through standard V4L2 ioctl paths (VIDIOC_STREAMON) and affects systems using Rockchip SoCs with the rkcif driver. The fix adds proper pad connection checks to prevent stream enablement on disconnected interfaces.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running Linux systems on Rockchip SoCs with camera interfaces; embedded systems manufacturers using rkcif driver; security teams monitoring kernel driver stability

Technical summary

The Rockchip Camera Interface (rkcif) driver in the Linux kernel fails to validate that media pads have connected devices before enabling streams. The pads lack the MUST_CONNECT flag check, permitting stream configuration on unconnected interfaces. When rkcif_interface_enable_streams() executes, it dereferences a null pointer (offset 0x20), causing a kernel oops. The crash occurs through the standard V4L2 streaming path: vb2_ioctl_streamon → v4l_streamon → __video_do_ioctl → vb2_core_streamon → vb2_start_streaming → rkcif_stream_start_streaming → v4l2_subdev_enable_streams → rkcif_interface_enable_streams. The resolution adds MUST_CONNECT flag validation to prevent stream enablement on disconnected pads.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available
  • Verify rkcif driver loads with properly configured media topology
  • Monitor kernel logs for rkcif_interface_enable_streams oops signatures
  • Restrict untrusted user access to V4L2 video devices
  • Review camera interface configurations for missing sensor connections

Evidence notes

Vulnerability description and resolution confirmed via NVD entry published 2026-05-28. Root cause identified as missing MUST_CONNECT flag validation in media pads. Crash signature confirmed: null pointer dereference at virtual address 0x20 in rkcif_interface_enable_streams(). Call trace provided in CVE description shows V4L2 streaming path. Fix commits referenced in source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46222 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46222

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46222 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46222

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/318142640590342bfec7aa06d0bdcd0ddbf953d0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8e3c751259dc2d1325838eff26f41032523c7b57

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.