CVE-2026-43235 Overview
CVE-2026-43235 affects the Linux kernel iris media driver, which provides video decode and encode support on Qualcomm SM8750 platforms. The vulnerability stems from two missing platform-data entries for the SM8750 SoC. Without get_vpu_buffer_size = iris_vpu33_buf_size, the driver fails to allocate required internal buffers, causing decode and encode session bring-up failures. Without max_core_mbps = ((7680 * 4320) / 256) * 60, capability checks remain incomplete and v4l2-compliance for the encoder fails. The issue has been resolved upstream through three stable kernel commits.
Critical Impact
The missing platform-data entries cause buffer allocation failures and incomplete capability exposure in the iris media driver, leading to broken video decode and encode functionality on SM8750 devices.
Affected Products
- Linux kernel iris media driver
- Qualcomm SM8750 SoC platforms
- Userspace clients relying on V4L2 video decode and encode interfaces
Discovery Timeline
- 2026-05-06 - CVE-2026-43235 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43235
Vulnerability Analysis
The Linux kernel iris driver supports Qualcomm Video Processing Unit (VPU) hardware used for video encode and decode. Each supported SoC requires a platform-data structure that exposes hardware-specific callbacks and capability constants. For the SM8750 platform, two required fields were omitted from the platform-data definition.
The first missing field, get_vpu_buffer_size, should point to the iris_vpu33_buf_size callback. This callback computes the size of internal scratch and persistent buffers needed before a session can begin. With the field unset, allocation requests return invalid sizes and decode or encode session bring-up fails.
The second missing field, max_core_mbps, defines the maximum macroblocks-per-second throughput supported by the core. The intended value of ((7680 * 4320) / 256) * 60 reflects 8K resolution at 60 frames per second. Without this constant, capability checks performed by the driver are incomplete, and v4l2-compliance testing of the encoder fails.
Root Cause
The root cause is incomplete initialization of the SM8750 platform-data table within the iris driver. Required function pointers and capability fields were not populated when SM8750 support was added, leaving downstream consumers with missing hardware metadata.
Attack Vector
No remote or local attack vector has been published for this issue. The reported impact is functional rather than security-exploitable: failed buffer allocation during media session setup and incomplete V4L2 capability exposure on SM8750 hardware.
No verified exploitation code is available. Refer to the upstream commits for technical details: Kernel Git Commit 1aa5833, Kernel Git Commit bbef55f, and Kernel Git Commit c7b2105a.
Detection Methods for CVE-2026-43235
Indicators of Compromise
- Kernel log messages indicating internal buffer allocation failures from the iris driver during V4L2 session start.
- Failed v4l2-compliance runs against the encoder node on SM8750 systems, particularly capability and format enumeration tests.
- User-visible decode or encode session initialization failures on devices using the iris driver against SM8750 silicon.
Detection Strategies
- Audit running kernel versions on SM8750 hardware and compare against the fixed commits referenced in the upstream stable tree.
- Run v4l2-compliance regression tests on encoder and decoder nodes to confirm capability checks pass.
- Validate that the loaded iris driver exposes a non-zero max_core_mbps capability through V4L2 control queries.
Monitoring Recommendations
- Monitor dmesg and journald for iris driver allocation errors during media workload startup.
- Track Linux kernel package versions across fleets to confirm the patched commits are deployed.
- Include V4L2 driver health checks in device provisioning pipelines for SM8750-based products.
How to Mitigate CVE-2026-43235
Immediate Actions Required
- Update the Linux kernel to a stable release containing the three referenced commits that add the missing SM8750 platform-data entries.
- Rebuild and reflash kernel images on affected SM8750 devices, then validate decode and encode functionality.
- Re-run v4l2-compliance after patching to confirm encoder capability checks pass.
Patch Information
The fix populates the SM8750 platform-data structure with get_vpu_buffer_size = iris_vpu33_buf_size and max_core_mbps = ((7680 * 4320) / 256) * 60. The change is distributed across Kernel Git Commit 1aa5833, Kernel Git Commit bbef55f, and Kernel Git Commit c7b2105a. Apply the patches from the Linux stable tree corresponding to your kernel branch.
Workarounds
- No supported workaround exists; the missing platform-data entries must be added in the kernel source and the driver rebuilt.
- On unpatched systems, avoid relying on iris decode and encode sessions on SM8750 hardware until kernel updates are applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
