CVE-2026-43189

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-async: Fix error handling on steps after finding a match

Once an async connection is found to be matching with an fwnode, a

sub-device may be registered (in case it wasn't already), its bound

operation is called, ancillary links are created, the async connection

is added to the sub-device's list of connections and removed from the

global waiting connection list. Further on, the sub-device's possible own

notifier is searched for possible additional matches.

Fix these specific issues:

- If v4l2_async_match_notify() failed before the sub-notifier handling,

the async connection was unbound and its entry removed from the

sub-device's async connection list. The latter part was also done in

v4l2_async_match_notify().

- The async connection's sd field was only set after creating ancillary

links in v4l2_async_match_notify(). It was however dereferenced in

v4l2_async_unbind_subdev_one(), which was call

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References