CVE-2026-43189: Linux Kernel Privilege Escalation Flaw

CVE-2026-43189 Overview

CVE-2026-43189 is a Linux kernel vulnerability in the v4l2-async media subsystem. The flaw involves incorrect error handling after an async connection matches a fwnode. When v4l2_async_match_notify() fails before the sub-notifier handling completes, the cleanup path performs unbinding and list operations that conflict with work already done inside the function. The async connection's sd field is also dereferenced in v4l2_async_unbind_subdev_one() despite being set only after ancillary links are created. Upstream maintainers have resolved the issue across multiple stable kernel branches.

Critical Impact
Improper error handling in the V4L2 async subsystem can lead to use-after-free conditions, list corruption, and potential kernel memory corruption when sub-device registration fails.

Affected Products

Linux kernel media subsystem (drivers/media/v4l2-core/v4l2-async.c)
Stable kernel branches receiving the referenced backport commits
Distributions shipping vulnerable Linux kernel versions prior to the fixes

Discovery Timeline

2026-05-06 - CVE-2026-43189 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43189

Vulnerability Analysis

The Video4Linux2 (V4L2) async framework manages registration ordering between sub-devices and notifiers. When an async connection matches a fwnode, the kernel invokes v4l2_async_match_notify() to register the sub-device, call its bound operation, create ancillary links, attach the connection to the sub-device's connection list, and remove it from the global waiting list. The function then searches the sub-device's own notifier for further matches.

The error path mishandles partial state. If v4l2_async_match_notify() fails before sub-notifier handling, the async connection is unbound and removed from the sub-device's connection list a second time, repeating work already performed. Additionally, the connection's sd field is set only after ancillary link creation, but the cleanup function v4l2_async_unbind_subdev_one() dereferences this field on the failure path.

Root Cause

The root cause is inconsistent ordering between state mutation and error rollback in v4l2_async_match_notify(). List membership transitions and pointer assignments are not aligned with the cleanup logic invoked on failure, producing double-removal and dereference of an unset field.

Attack Vector

Triggering the flaw requires reaching the async match notify error path in the V4L2 core. This typically depends on local conditions involving media device registration, driver probing, or controlled allocation failures. No remote attack vector is described in the advisory and no public exploit is available.

The vulnerability is described in prose by the upstream commit messages. See the kernel git commit for the patch that reorders state updates and corrects the error path.

Detection Methods for CVE-2026-43189

Indicators of Compromise

Kernel oops or panic messages referencing v4l2_async_unbind_subdev_one or v4l2_async_match_notify in dmesg and /var/log/kern.log
List debugging warnings (list_del corruption) tied to V4L2 async connection lists
Unexpected sub-device registration failures during media driver probe

Detection Strategies

Inventory running kernel versions using uname -r and compare against the fixed commits referenced in the advisory
Monitor kernel logs for crash signatures originating in drivers/media/v4l2-core/v4l2-async.c
Use distribution package managers to confirm whether installed kernel packages include the backported fixes

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log platform and alert on V4L2 stack traces
Track media subsystem errors on systems with cameras, capture cards, or SoC media pipelines
Watch for repeated probe failures of media drivers, which can indicate the error path is being exercised

How to Mitigate CVE-2026-43189

Immediate Actions Required

Apply vendor kernel updates that include the upstream fix commits referenced in the advisory
Reboot affected systems after kernel package updates to load the patched image
Restrict local access on systems running unpatched kernels with V4L2 hardware enabled

Patch Information

The fix is committed across multiple stable branches. Reference commits include 2de0a3c8148f, 30aaed311f97, 461733d83e67, 7345d6d35633, and b02bcb378efa. Install the kernel package from your Linux distribution that incorporates these changes.

Workarounds

Unload or blacklist V4L2 media drivers on systems that do not require camera or capture functionality
Limit local user access on hosts where the patched kernel cannot be deployed immediately
Disable hot-pluggable media hardware until the kernel is updated

bash

# Verify running kernel and update to a patched build
uname -r
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot