PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46310 Linux CVE debrief

A vulnerability has been resolved in the Linux kernel, specifically in the media: renesas: vsp1 module. When unloading the module on gen 4, a NULL pointer dereference occurs due to the cleanup code calling the incorrect function. The fix involves checking the IP version and calling the correct drm or vspx function.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel, particularly those using the renesas: vsp1 module, should be aware of this vulnerability and take steps to update their kernel to a version that includes the fix.

Technical summary

The vulnerability is caused by the cleanup code calling vsp1_drm_cleanup() instead of vsp1_vspx_cleanup() when unloading the module on gen 4. This results in a NULL pointer dereference. The fix checks the IP version and calls the correct function.

Defensive priority

medium

Recommended defensive actions

  • Update the Linux kernel to a version that includes the fix.
  • Check for and apply any available patches for the renesas: vsp1 module.

Evidence notes

The vulnerability was resolved in the Linux kernel. The fix involves checking the IP version and calling the correct drm or vspx function.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46310 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46310

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46310 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46310

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/58b1e9664d8f74d55d8411cc7a7b275a76a6f24f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bfb2081ba00afbbd15a5ed1ed1acdc3edeea5a98

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c4bb1515b26663e5230603892e67f2cc7df9f0ca

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.