CVE-2026-43310 Overview
CVE-2026-43310 affects the Linux kernel's Verisilicon Video Processing Unit (VPU) driver. The vulnerability impacts the hantro-vpu media driver used on the i.MX8MQ platform. A hardware limitation prevents the g1 and g2 VPUs from decoding simultaneously, and the driver did not enforce alternating operation. Concurrent decode operations trigger a bus error, produce corrupted output frames, and can hang the system.
The issue manifests during multi-instance decoding of H.264 and HEVC streams. A local user with access to the video device can trigger denial-of-service conditions affecting media subsystem availability.
Critical Impact
Local users can trigger VPU bus errors that produce corrupted decoded pictures and may hang the affected system, disrupting media workloads on i.MX8MQ hardware.
Affected Products
- Linux kernel (mainline) prior to fix commit e0203ddf9af7
- Linux stable kernel branches prior to backport commit 286d629d1064
- Systems using the Verisilicon hantro-vpu driver on NXP i.MX8MQ platforms
Discovery Timeline
- 2026-05-08 - CVE-2026-43310 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-43310
Vulnerability Analysis
The Verisilicon hantro-vpu driver in drivers/media/platform/verisilicon/ supports two decoder cores on the i.MX8MQ: g1 and g2. The hardware does not permit concurrent operation of both cores. When userspace opens multiple Video4Linux2 memory-to-memory (V4L2 M2M) instances and issues decode jobs to g1 and g2 at the same time, the bus arbitration fails.
The kernel log records the failure as hantro-vpu 38310000.video-codec: frame decode timed out followed by hantro-vpu 38310000.video-codec: bus error detected. The decoded frames are corrupted, and the SoC interconnect may stall, leading to a system hang.
The vulnerability is classified by NVD as NVD-CWE-noinfo and primarily presents as a denial-of-service condition with no confidentiality or integrity impact.
Root Cause
The root cause is a missing scheduling constraint in the driver. Each VPU core registered an independent v4l2_m2m_dev scheduler instance. The V4L2 M2M framework therefore had no visibility into the cross-core hardware contention. Nothing prevented g1 and g2 jobs from running concurrently, violating the platform's mutual-exclusion requirement.
Attack Vector
A local user holding access to /dev/videoX nodes can open multiple decoder instances and feed H.264 and HEVC streams to both cores. The unsynchronized decode jobs race on the shared bus and produce the fault. No authentication beyond standard device-node permissions is required, and no user interaction is involved.
The upstream fix makes g1 and g2 share a single v4l2_m2m_dev instance. Sharing the scheduler forces the M2M framework to serialize jobs across both cores, ensuring alternating operation. The patch is recorded in commits e0203ddf9af7 and 286d629d1064.
Detection Methods for CVE-2026-43310
Indicators of Compromise
- Kernel log entries containing hantro-vpu followed by frame decode timed out
- Kernel log entries containing hantro-vpu followed by bus error detected
- Corrupted decoded video frames produced by H.264 or HEVC pipelines on i.MX8MQ hardware
- Unexpected system hangs correlated with multi-instance video decoding workloads
Detection Strategies
- Audit running kernel versions against the fix commits e0203ddf9af7 and 286d629d1064 on i.MX8MQ deployments.
- Monitor dmesg and journald for hantro-vpu error strings to identify exposed systems.
- Inventory devices exposing /dev/video* nodes backed by the Verisilicon driver and review which user accounts can access them.
Monitoring Recommendations
- Forward kernel ring buffer logs to a centralized log platform and alert on bus error detected strings.
- Track decoder watchdog timeouts and frame drops in media application telemetry.
- Correlate process activity opening V4L2 nodes with subsequent kernel media subsystem errors.
How to Mitigate CVE-2026-43310
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits e0203ddf9af7 and 286d629d1064.
- Restrict access to V4L2 video device nodes on i.MX8MQ systems to trusted service accounts only.
- Update embedded Linux board support packages from NXP and downstream vendors that include the Verisilicon driver fix.
Patch Information
The fix consolidates the g1 and g2 cores under a shared v4l2_m2m_dev, allowing the M2M framework to schedule jobs alternately. Distribution and embedded vendors should rebase to a kernel containing the stable commit 286d629d1064 or the mainline commit e0203ddf9af7.
Workarounds
- Limit decode workloads to a single VPU core where the application stack supports it, avoiding concurrent g1 and g2 usage.
- Tighten file permissions on /dev/video* nodes via udev rules to restrict local exposure.
- Disable the unused VPU core in device tree configurations on systems that do not require multi-codec decode.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
