PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46312 Linux CVE debrief

A vulnerability was found in the Linux kernel's videobuf2 module. The vulnerability occurs when the `vb2_dma_sg_mmap` function does not set the `VM_DONTEXPAND` and `VM_DONTDUMP` flags, which can cause a warning in the `drm_gem_mmap_obj` function during the mmap operation of an imported dma-buf from the out-of-tree Apple ISP camera capture driver.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-06-08
Advisory published
2026-06-08
Advisory updated
2026-06-08

Who should care

Users of the Linux kernel, particularly those using the videobuf2 module, should be aware of this vulnerability.

Technical summary

The vulnerability is caused by the `vb2_dma_sg_mmap` function not setting the `VM_DONTEXPAND` and `VM_DONTDUMP` flags. This can cause a warning in the `drm_gem_mmap_obj` function during the mmap operation of an imported dma-buf from the out-of-tree Apple ISP camera capture driver.

Defensive priority

Medium

Recommended defensive actions

  • Update the Linux kernel to a version that includes the fix for this vulnerability.
  • Use a kernel version that has the videobuf2 module with the `VM_DONTEXPAND` and `VM_DONTDUMP` flags set.

Evidence notes

The vulnerability was fixed by setting the `VM_DONTEXPAND` and `VM_DONTDUMP` flags in the `vb2_dma_sg_mmap` function.

Official resources

public