SB2026102413 - Improper control of a resource through its lifetime in Linux kernel media i2c driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98915)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by interacting with a video device during driver removal.

The vulnerability exists due to improper resource lifecycle management in the Linux kernel video-i2c driver when unregistering a video device without first disconnecting its videobuf2 queue. A local user can use a video device across driver removal to potentially disrupt kernel operation through access to a queue that has not been properly disconnected.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/56384b486b80ce4a2bc93689aae49995f908f90d
• https://git.kernel.org/stable/c/82e432c9ebfa13fb8d47d6d550be5d7d2a84a8ab
• https://git.kernel.org/stable/c/97adc8cd04df2085f7fd437838005f3bb16bafae
• https://git.kernel.org/stable/c/b7afb0c24a761c2367e5fa87a9941d67d373c127
• https://git.kernel.org/stable/c/b8fba9f66019d4c83235c4219ff8edeb7e3af20d