PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46313 Linux CVE debrief

A vulnerability has been resolved in the Linux kernel related to the media: intel/ipu6 module. The vulnerability is caused by a potential error pointer dereference in the ipu6_pci_probe() function. In an error path, isp->psys is confirmed to be an error pointer, not NULL, and is subsequently dereferenced. To fix this issue, isp->psys should be set to NULL before going to out_ipu6_bus_del_devices.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel with the media: intel/ipu6 module enabled should be aware of this vulnerability.

Technical summary

The vulnerability is caused by a potential error pointer dereference in the ipu6_pci_probe() function. In an error path, isp->psys is confirmed to be an error pointer, not NULL, and is subsequently dereferenced.

Defensive priority

medium

Recommended defensive actions

  • Apply the patches provided by the Linux kernel maintainers to fix the vulnerability.
  • Review the code changes to ensure that the fix is properly implemented.

Evidence notes

The vulnerability was detected by Smatch.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46313 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46313

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46313 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46313

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8dd088b8b106f7b119664f965b691785998edcfb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c352f90e093ae49902e47f41579e1aa41899ff64

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f43e30646fc93799f3f48530d0ccbd52902c0541

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fad134c446189e9bb48cea1a5ca426d2889a9c71

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.