CVE-2026-43263

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable path is reached through local V4L2 mem2mem device operations on the Wave5 decoder/encoder video node, using open/close and streaming ioctls. It is not directly reachable from network, adjacent wireless, or physical hotplug input.

AC:LAttack complexity, low

The race is created by the attacker by running multiple codec instances, queuing decode/encode work, and closing instances while hardware completion interrupts are generated. The attacker controls the relevant workload and can retry, so no external uncontrollable condition is required.

PR:LPrivileges required, low

The driver performs no capability or authentication checks in its open/ioctl path, but the attacker must have local access to the video device node as an unprivileged user or media client. There is no requirement for real root or init-namespace administrative privileges.

UI:NUser interaction, none

Once the attacker has local access to the device node or media client path, exploitation only requires attacker-issued ioctls and close operations. No separate victim action is needed.

S:UScope, unchanged

The bug is in a kernel media driver and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.

C:HConfidentiality impact, high

Although reported as a NULL reference, the unlocked instance list allows interrupt completion handling to dereference `struct vpu_instance` and associated V4L2 mem2mem state while teardown is removing or freeing those objects. As a kernel use-after-free race, the highest defensible impact includes kernel memory disclosure.

I:HIntegrity impact, high

The same use-after-free race reaches function-pointer and object-state dereferences such as `inst->ops->finish_process(inst)` after concurrent teardown. With heap reuse/spraying, the highest defensible impact includes arbitrary kernel control flow or memory modification.

A:HAvailability impact, high

The observed and most direct impact is a NULL dereference/use-after-free during interrupt handling, producing an oops or kernel panic. The trigger can be repeated by a local attacker running codec instances.