CVE-2026-46222

MEDIUM EPSS 1.3%

Published May 28, 20261mo ago · Modified Jun 17, 20261w ago

5.5 CVSS 3.1

Medium

Published May 28, 2026 1mo ago

Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads The pads missed checks for connected devices which may a null dereference when the stream is enabled. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 pc : rkcif_interface_enable_streams+0x48/0xf0 lr : rkcif_interface_enable_streams+0x44/0xf0 Call trace: rkcif_interface_enable_streams+0x48/0xf0 v4l2_subdev_enable_streams+0x26c/0x3f0 rkcif_stream_start_streaming+0x140/0x278 vb2_start_streaming+0x74/0x188 vb2_core_streamon+0xe0/0x1d8 vb2_ioctl_streamon+0x60/0xa8 v4l_streamon+0x2c/0x40 __video_do_ioctl+0x34c/0x400 video_usercopy+0x2d0/0x800 video_ioctl2+0x20/0x60 v4l2_ioctl+0x48/0x78

CVSS Details

Base Score

5.5

Exploitability

1.8

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

1.3% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 1

Vendor	Product	Version	Range
linux	linux_kernel	*	≥6.19 – <7.0.9

References 2

git.kernel.org https://git.kernel.org/stable/c/318142640590342bfec7aa06d0bdcd0ddbf953d0

Patch
git.kernel.org https://git.kernel.org/stable/c/8e3c751259dc2d1325838eff26f41032523c7b57

Patch

Remediation

git.kernel.org https://git.kernel.org/stable/c/318142640590342bfec7aa06d0bdcd0ddbf953d0

Patch
git.kernel.org https://git.kernel.org/stable/c/8e3c751259dc2d1325838eff26f41032523c7b57

Patch