CVE-2026-43316: Linux Kernel solo6x10 Bounds Vulnerability

CVE-2026-43316 Overview

CVE-2026-43316 affects the Linux kernel solo6x10 media driver, where an out-of-bounds chip_id value can trigger an undefined shift operation. A signed integer literal 1 could be shifted beyond 32 bits inside the is_tw286x() helper, producing undefined behavior detected by Clang's CONFIG_UBSAN_SHIFT=y instrumentation. Because Clang treats undefined behavior as unreachable, it elides subsequent code in the function, leading to incorrect runtime logic. The flaw requires local access with low privileges and primarily impacts availability on systems using affected solo6x10 video capture hardware drivers.

Critical Impact
A local user can trigger undefined behavior in the solo6x10 media driver shift operation, resulting in elided function logic and potential denial of service on affected Linux kernel builds.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Linux Kernel 7.0-rc1 through 7.0-rc7
Systems loading the solo6x10 media driver for Softlogic 6x10 video capture cards

Discovery Timeline

2026-05-08 - CVE-2026-43316 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43316

Vulnerability Analysis

The vulnerability resides in the solo6x10 media driver within the Linux kernel's drivers/media/pci/solo6x10/ source tree. The is_tw286x() helper performs a shift operation using a signed int literal 1, with the chip_id value acting as the shift amount. When chip_id exceeds 31, the shift exceeds the width of a 32-bit int, which is undefined behavior under the C standard [CWE-758].

Clang with CONFIG_UBSAN_SHIFT=y enabled inserts runtime instrumentation for such shifts. Due to inlining, the compiler observes the helper invoked twice and concludes the second invocation must be unreachable undefined behavior, removing the rest of the calling function. This elision causes the driver to skip critical code paths during chip identification.

Root Cause

The root cause is a missing bounds check on chip_id before it is used as a shift count, combined with use of a signed shift base. Without validation, chip_id values outside the supported chip range produce out-of-bounds shifts. The fix adds an explicit bounds check against the maximum supported chip ID and converts the shift base to an unsigned type, eliminating the undefined behavior and removing the need for UBSAN instrumentation.

Attack Vector

Exploitation requires local access with low privileges on a system that loads the solo6x10 driver. An attacker capable of influencing the chip_id value, or operating on a build compiled with aggressive optimization plus UBSAN shift instrumentation, can cause the function to behave incorrectly. The practical impact is loss of availability for the media subsystem rather than confidentiality or integrity compromise.

No public exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.013%, reflecting low likelihood of in-the-wild exploitation.

Detection Methods for CVE-2026-43316

Indicators of Compromise

Kernel log messages from the solo6x10 driver indicating abnormal chip identification or initialization failure
UBSAN runtime reports referencing shift-out-of-bounds in is_tw286x on instrumented kernels
Unexpected unloading or hangs of the solo6x10 module on systems with Softlogic 6x10 capture hardware

Detection Strategies

Audit installed kernel versions against the fixed commits listed in the Linux Kernel stable tree
Enable CONFIG_UBSAN_SHIFT=y in non-production builds to surface shift-related undefined behavior
Inventory hosts loading the solo6x10 kernel module using lsmod | grep solo6x10

Monitoring Recommendations

Collect dmesg and journalctl -k output for UBSAN and driver-specific warnings
Monitor module load events and kernel oops conditions through host telemetry pipelines
Track patch deployment status against the published vendor advisory commits

How to Mitigate CVE-2026-43316

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits for your kernel branch
Restrict local access to systems running affected kernels and the solo6x10 driver
If the driver is not required, blacklist the solo6x10 module to remove the attack surface

Patch Information

The Linux kernel maintainers committed fixes across multiple stable branches. Relevant commits include 0b3dadada241, 0fdf6323c35a, 33af366211ee, 4d6db0c6bbbf, 5849ae68d7b8, 603e3859393e, c327192ca266, and d29f33b2cf98. The fix adds explicit bounds checks on chip_id and changes the shift base to an unsigned type.

Workarounds

Blacklist the solo6x10 module in /etc/modprobe.d/ if Softlogic 6x10 video capture is not in use
Limit physical and remote shell access to hosts that load the affected driver
Rebuild kernels without CONFIG_VIDEO_SOLO6X10 if the hardware is not deployed

bash

# Configuration example: blacklist the solo6x10 driver
echo "blacklist solo6x10" | sudo tee /etc/modprobe.d/blacklist-solo6x10.conf
sudo depmod -a
sudo update-initramfs -u
sudo modprobe -r solo6x10 2>/dev/null || true