CVE-2026-43256: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43256 Overview

CVE-2026-43256 is an out-of-bounds memory access vulnerability in the Linux kernel's Qualcomm Camera Subsystem (CAMSS) Video Front End (VFE) driver. The flaw resides in the vfe_isr_reg_update() function within the media: qcom: camss: vfe subsystem. The interrupt service routine vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM (value 7) as the loop bound and passes the index to vfe_isr_reg_update(). However, the vfe->line[] array is sized using VFE_LINE_NUM_MAX (value 4). When the index reaches 4, 5, or 6, accesses to vfe->line[line_id] exceed the array boundary. This produces out-of-bounds memory reads or writes within an interrupt context.

Critical Impact
Out-of-bounds memory access in a kernel interrupt handler can lead to memory corruption, kernel panic, or denial of service on Qualcomm-based Linux platforms using the CAMSS VFE driver.

Affected Products

Linux kernel versions containing the Qualcomm CAMSS VFE driver prior to the upstream fix
Linux distributions packaging the affected drivers/media/platform/qcom/camss source
Qualcomm SoC platforms relying on the VFE camera pipeline driver

Discovery Timeline

2026-05-06 - CVE-2026-43256 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43256

Vulnerability Analysis

The vulnerability stems from a mismatch between two compile-time constants used by the same iteration logic. The interrupt handler vfe_isr() walks a bitmap or status register that tracks per-master events using MSM_VFE_IMAGE_MASTERS_NUM, defined as 7. For each iteration, the handler invokes vfe_isr_reg_update(), which dereferences vfe->line[line_id].

The line[] array is declared as struct vfe_line line[VFE_LINE_NUM_MAX], where VFE_LINE_NUM_MAX equals 4. When the iteration index reaches 4, 5, or 6, the dereference reads adjacent kernel memory beyond the allocated array. The fix splits the single loop into separate loops bounded correctly for output lines and write masters, ensuring each index stays within its respective array.

Root Cause

The root cause is improper bounds enforcement [CWE-787 / CWE-125] caused by reusing one loop counter for two collections of differing sizes. The output line[] array and the write master set were conflated in the original ISR logic. The original code assumed all 7 image master indices mapped to valid entries in line[], which holds only 4 entries.

Attack Vector

Triggering this condition requires the VFE hardware to raise interrupts for image master indices above 3. Because the access occurs inside an interrupt service routine, exploitation requires privileges or hardware states sufficient to drive the camera pipeline. The most realistic outcome is a kernel oops or system instability rather than controlled exploitation. Refer to the upstream kernel commits referenced below for the exact patch diff.

Vulnerability mechanism (prose description):

vfe_isr() {
    for (i = 0; i < MSM_VFE_IMAGE_MASTERS_NUM /* 7 */; i++)
        vfe_isr_reg_update(vfe, i);   // accesses vfe->line[i]
}

struct vfe_device {
    struct vfe_line line[VFE_LINE_NUM_MAX]; // size = 4
};

// When i = 4..6, vfe->line[i] reads out-of-bounds memory.
// Fix: split into two loops with the correct upper bound for each domain.

Detection Methods for CVE-2026-43256

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing vfe_isr_reg_update or vfe_isr in drivers/media/platform/qcom/camss
Unexpected reboots or hangs on Qualcomm devices when the camera subsystem is active
KASAN slab-out-of-bounds reports involving struct vfe_device or vfe_line structures

Detection Strategies

Identify running kernel versions across Linux fleets and compare against the patched commits 0c074e80, 1b103307, d965919a, e6cbf765, e7a38ecd, and fade67c8
Enable KASAN on test kernels to surface out-of-bounds accesses in the CAMSS VFE driver during camera workloads
Review kernel ring buffer messages (dmesg) for stack traces involving the VFE interrupt path

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized logging or SIEM platform for stack-trace analysis
Track kernel package versions across Qualcomm-based endpoints and embedded fleets to confirm patch coverage
Alert on repeated kernel oops events sourced from the qcom-camss module

How to Mitigate CVE-2026-43256

Immediate Actions Required

Upgrade to a Linux kernel release that incorporates the upstream fix referenced by commits 0c074e80, 1b103307, d965919a, e6cbf765, e7a38ecd, or fade67c8
Apply distribution stable-tree updates that backport the CAMSS VFE fix to long-term support kernels
For embedded and Android-derived platforms, rebuild kernel images with the patched drivers/media/platform/qcom/camss/camss-vfe.c

Patch Information

The fix replaces the single loop bounded by MSM_VFE_IMAGE_MASTERS_NUM with two separate loops: one bounded by the number of output lines, and one bounded by the number of write masters. This prevents vfe->line[line_id] from being indexed beyond VFE_LINE_NUM_MAX. See the upstream patches: Kernel Git Commit 0c074e80, Kernel Git Commit 1b103307, Kernel Git Commit d965919a, Kernel Git Commit e6cbf76, Kernel Git Commit e7a38ecd, and Kernel Git Commit fade67c8.

Workarounds

Where patching is delayed, blacklist the qcom-camss kernel module on systems that do not require the camera subsystem
Restrict access to camera device nodes via udev rules to limit which processes can drive the VFE pipeline
Disable camera functionality at the firmware or device-tree level on affected Qualcomm platforms until kernel updates are deployed

bash

# Configuration example: blacklist the affected module on systems not using the camera
echo "blacklist qcom-camss" | sudo tee /etc/modprobe.d/blacklist-qcom-camss.conf
sudo update-initramfs -u
sudo reboot

# Verify the module is not loaded after reboot
lsmod | grep -i camss