Kernel: media: i2c: max9286: fix kernel oops when removing module
Summary
GSD-2022-1003424: media: i2c: max9286: fix kernel oops when removing module. Affects Kernel versions >= 66d8c9d2422da21ed41f75c03ba0685987b65fe0, < a4ec75df70575cdf33d9638c7844e729bfe6ce24. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It is responsible for managing system resources, including memory, processes, and input/output operations. The media subsystem in the Kernel handles various media-related functionalities, such as video capture and playback. The i2c subsystem is used for communication with I2C devices, which are commonly used for connecting sensors and other peripherals. The max9286 driver in the media subsystem is responsible for managing the MAX9286 serializer, which is used in automotive camera applications. This vulnerability in the max9286 driver can lead to a kernel oops (crash) when the module is removed.
Vulnerability Detail
The vulnerability in the max9286 driver occurs when the module is removed from the Kernel. It triggers a kernel oops, resulting in a crash. This vulnerability can be exploited by an attacker with local access to the system to cause a denial-of-service (DoS) condition. The impact of this vulnerability is limited to systems that have the max9286 driver loaded and actively used. The vulnerability was introduced in version v5.9 of the Linux Kernel and is fixed in version v5.15.46.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to apply the fix by updating their Linux Kernel to the recommended version.
Conclusion
The vulnerability in the max9286 driver of the Linux Kernel can lead to a kernel oops and system crash when the module is removed. To mitigate this vulnerability, users should update their Linux Kernel to version v5.15.46 or later. There are no known instances of this vulnerability being exploited, and remote exploitation is not possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a kernel oops and system crash, resulting in a denial-of-service (DoS) condition. However, the impact is limited to systems with the max9286 driver loaded and actively used.
You can check if your system is affected by this vulnerability by verifying the version of the Linux Kernel installed. If your system is running version v5.9 or later and has the max9286 driver loaded, it may be vulnerable. You can also use vulnerability monitoring tools like Vulert (https://vulert.com) to check for the presence of this vulnerability.
No, this vulnerability requires local access to the system to exploit. Remote exploitation is not possible.
There are no known instances of this vulnerability being exploited in the wild.
For more details about this vulnerability, including the specific code changes that fix it, you can refer to the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and the associated commit history.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
