CVE-2026-43189

{"id": "CVE-2026-43189", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43189", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:30:30.833413Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "28a1295795d85a25f2e7dd391c43969e95fcb341", "lessThan": "30aaed311f973f13ba13a0cd2dc0202f595fff48", "versionType": "git"}, {"status": "affected", "version": "28a1295795d85a25f2e7dd391c43969e95fcb341", "lessThan": "461733d83e67ba7e3a5b750c0d203f738e01244f", "versionType": "git"}, {"status": "affected", "version": "28a1295795d85a25f2e7dd391c43969e95fcb341", "lessThan": "b02bcb378efa8af07827f49b3afcc5e825318c55", "versionType": "git"}, {"status": "affected", "version": "28a1295795d85a25f2e7dd391c43969e95fcb341", "lessThan": "2de0a3c8148fc3dbea21981e6569f550b3626119", "versionType": "git"}, {"status": "affected", "version": "28a1295795d85a25f2e7dd391c43969e95fcb341", "lessThan": "7345d6d356336c448d6b9230ed8704f39679fd12", "versionType": "git"}], "programFiles": ["drivers/media/v4l2-core/v4l2-async.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"status": "unaffected", "version": "0", "lessThan": "6.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.128", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/media/v4l2-core/v4l2-async.c"], "defaultStatus": "affected"}]}], "published": "2026-05-06T12:16:37.723", "references": [{"url": "https://git.kernel.org/stable/c/2de0a3c8148fc3dbea21981e6569f550b3626119", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/30aaed311f973f13ba13a0cd2dc0202f595fff48", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/461733d83e67ba7e3a5b750c0d203f738e01244f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7345d6d356336c448d6b9230ed8704f39679fd12", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b02bcb378efa8af07827f49b3afcc5e825318c55", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-async: Fix error handling on steps after finding a match\n\nOnce an async connection is found to be matching with an fwnode, a\nsub-device may be registered (in case it wasn't already), its bound\noperation is called, ancillary links are created, the async connection\nis added to the sub-device's list of connections and removed from the\nglobal waiting connection list. Further on, the sub-device's possible own\nnotifier is searched for possible additional matches.\n\nFix these specific issues:\n\n- If v4l2_async_match_notify() failed before the sub-notifier handling,\n the async connection was unbound and its entry removed from the\n sub-device's async connection list. The latter part was also done in\n v4l2_async_match_notify().\n\n- The async connection's sd field was only set after creating ancillary\n links in v4l2_async_match_notify(). It was however dereferenced in\n v4l2_async_unbind_subdev_one(), which was called on error path of\n v4l2_async_match_notify() failure."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: v4l2-async: Corregir el manejo de errores en los pasos posteriores a encontrar una coincidencia\n\nUna vez que se encuentra que una conexi\u00f3n as\u00edncrona coincide con un fwnode, un subdispositivo puede ser registrado (en caso de que no lo estuviera ya), se llama a su operaci\u00f3n de enlace, se crean enlaces auxiliares, la conexi\u00f3n as\u00edncrona se a\u00f1ade a la lista de conexiones del subdispositivo y se elimina de la lista global de conexiones en espera. M\u00e1s adelante, se busca en el posible notificador propio del subdispositivo posibles coincidencias adicionales.\n\nCorregir estos problemas espec\u00edficos:\n\n- Si v4l2_async_match_notify() fallaba antes del manejo del sub-notificador, la conexi\u00f3n as\u00edncrona se desenlazaba y su entrada se eliminaba de la lista de conexiones as\u00edncronas del subdispositivo. Esta \u00faltima parte tambi\u00e9n se realizaba en v4l2_async_match_notify().\n\n- El campo sd de la conexi\u00f3n as\u00edncrona solo se establec\u00eda despu\u00e9s de crear enlaces auxiliares en v4l2_async_match_notify(). Sin embargo, se desreferenciaba en v4l2_async_unbind_subdev_one(), que se llamaba en la ruta de error del fallo de v4l2_async_match_notify()."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0FD95A9-209E-44A8-8F1D-1EB130F75861", "versionEndExcluding": "6.6.128", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}