PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46239 Linux CVE debrief

A runtime Power Management (PM) reference count leak exists in the OV5647 camera sensor driver within the Linux kernel media subsystem. The vulnerability occurs in the s_ctrl function where three specific V4L2 control cases—AUTOGAIN, EXPOSURE_AUTO, and ANALOGUE_GAIN—execute direct returns without invoking pm_runtime_put(). This omission causes the runtime PM reference count to increment without corresponding decrement, leading to resource leaks that prevent proper power state transitions and may cause device power management failures over time. The fix restructures these control handlers to use a 'ret = ... break' pattern, ensuring pm_runtime_put() executes before function exit regardless of control path taken. This is a local vulnerability affecting systems with OV5647 camera hardware; exploitation requires ability to issue V4L2 control commands to the device.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations deploying Linux-based embedded systems with OV5647 camera sensors; IoT device manufacturers; kernel maintainers for distributions supporting ARM/embedded platforms; security teams tracking kernel driver quality issues

Technical summary

The OV5647 is an OmniVision 5-megapixel CMOS image sensor commonly used in embedded systems including Raspberry Pi cameras. The driver implements V4L2 subdevice controls through ov5647_s_ctrl(). When handling V4L2_CID_AUTOGAIN, V4L2_CID_EXPOSURE_AUTO, or V4L2_CID_ANALOGUE_GAIN controls, the original code performed immediate returns after pm_runtime_get_sync(), skipping the mandatory pm_runtime_put() call at function exit. The corrected implementation assigns return values to 'ret' and breaks to common cleanup code, ensuring balanced runtime PM reference counting. This defect could prevent the sensor from reaching low-power states or cause pm_runtime_get_sync() to hang on subsequent calls when the reference count saturates.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available; commits 6b03ecf75bda and f11ae9c04f836 contain the fix
  • Monitor NVD for CVSS scoring once analysis completes
  • Verify OV5647 driver usage in deployed systems via 'lsmod | grep ov5647' or device tree inspection
  • Review custom V4L2 control implementations for similar pm_runtime_get/put imbalance patterns
  • Enable CONFIG_DEBUG_FS and inspect /sys/kernel/debug/pm_runtime for abnormal reference counts on ov5647 devices if runtime PM issues suspected

Evidence notes

Vulnerability confirmed by kernel commit messages describing the refcount leak pattern and fix implementation. No CVSS score assigned; NVD status 'Awaiting Analysis'. Vendor identification marked low confidence requiring review—'Unknown Vendor' with 'Kernel' domain evidence.

Official resources

2026-05-28