Riskcovery

CVE-2024-43833

media: v4l: async: Fix NULL pointer dereference in adding ancillary links

State
Published
Severity
Not scored
Published
Aug 17, 2024
Updated
May 11, 2026
Reserved
Aug 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

media: v4l: async: Fix NULL pointer dereference in adding ancillary links

In v4l2_async_create_ancillary_links(), ancillary links are created for lens and flash sub-devices. These are sub-device to sub-device links and if the async notifier is related to a V4L2 device, the source sub-device of the ancillary link is NULL, leading to a NULL pointer dereference. Check the notifier's sd field is non-NULL in v4l2_async_create_ancillary_links().

[Sakari Ailus: Reword the subject and commit messages slightly.]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • aa4faf6eb27132532d5a133d9241254c16d4bafa to before fe0f92fd5320b393e44ca210805e653ea90cc982Affected
  • aa4faf6eb27132532d5a133d9241254c16d4bafa to before 249212ceb4187783af3801c57b92a5a25d410621Affected
  • aa4faf6eb27132532d5a133d9241254c16d4bafa to before b87e28050d9b0959de24574d587825cfab2f13fbAffected
  • aa4faf6eb27132532d5a133d9241254c16d4bafa to before 9b4667ea67854f0b116fe22ad11ef5628c5b5b5fAffected
LinuxLinux
  • 5.19Affected
  • before 5.19Not affected
  • 6.1.103 through 6.1.*Not affected
  • 6.6.44 through 6.6.*Not affected
  • 6.10.3 through 6.10.*Not affected
  • 6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.