Null Dereference Vulnerability in Linux Kernel Media Chips

CVE-2026-43263

What is CVE-2026-43263?

A vulnerability has been identified in the Linux kernel, specifically within the media chips component related to wave5. This issue arises when multiple instances are created or destroyed, leading to a series of interrupts that may result in null dereference due to inadequate locking mechanisms. The shared structure 'vpu_instance' is utilized across all flows within the decoder, and without proper protection, this can lead to potential system instability. A modification in the IRQ handler has been implemented, which involves splitting the handler into two phases and introducing a locking mechanism to mitigate the risks associated with this vulnerability.

References