SB20260812333 - Improper resource shutdown or release in Linux kernel sunxi sun4i-csi driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-68209)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the sun4i_csi_start_streaming() path of the sun4i-csi driver when handling streaming startup with an unsupported CSI format. A local user can trigger streaming initialization with a format that has no matching CSI format to cause a denial of service.

The issue occurs because queued video buffers are not returned on the error path after they have already been handed to the driver by the vb2 framework.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4872161e6fbe4e1783daea8bff79caddfae0fb82
• https://git.kernel.org/stable/c/668face37fdb6b6900645dc8777195498541c9a7
• https://git.kernel.org/stable/c/a8abecc638a7feb20b78fabd563b05e30c071331
• https://git.kernel.org/stable/c/b5184b3f0e9d4cc47059ba1138c9a73d43d2493f
• https://git.kernel.org/stable/c/bbba3e260a62810a717b4442a3bb96d0ec0f6309