CVE-2026-68226 - Vulnerability Details

- media: cx23885: add ioremap return check and cleanup

Description

In the Linux kernel, the following vulnerability has been resolved:

media: cx23885: add ioremap return check and cleanup

Add a check for the return value of pci_ioremap_bar()
in cx23885_dev_setup().
If ioremap for BAR0 fails, release the already allocated
PCI memory region,
decrement the device count, and return -ENODEV.

This prevents a potential null pointer dereference and
ensures proper cleanup
on memory mapping failure.

Published: 2026-08-10

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s media driver for the cx23885 device performed a PCI I/O memory mapping without checking the return value of pci_ioremap_bar(). If this mapping failed, the driver would later dereference a null pointer, triggering a kernel panic. This flaw is a classic CWE‑476 null pointer dereference that can cause a local denial‑of‑service by crashing the system.

Affected Systems

All Linux kernel releases that include the unpatched cx23885 media driver are vulnerable. The vulnerability does not specify a particular kernel version range, so any kernel containing the legacy driver before the commit that added the ioremap return check is affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.5, indicating moderate severity, and an EPSS score of less than 1%, reflecting a very low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires the presence of a cx23885 PCI device and the kernel attempting to load and initialize the driver; thus the attack vector is likely local, potentially via a malicious or faulty device inserted into the system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d19770e5178a4bc49641711246360c25781d20a4`	affected	< f58f4b571bd75c78bbf15441086ba0c2830c1aa5
`d19770e5178a4bc49641711246360c25781d20a4`	affected	< 9052fec0bb84eace81ac7bad071266052870cdf3
`d19770e5178a4bc49641711246360c25781d20a4`	affected	< 6a7636e3d5204fb18fdf1c3f909a3d9d9e24064c
`d19770e5178a4bc49641711246360c25781d20a4`	affected	< 8fbdca4c99f68734e9b6c030973fb61a11bede15
`d19770e5178a4bc49641711246360c25781d20a4`	affected	< 83540d86d717735b52a43e4ba1b784da5cc2310a
`d19770e5178a4bc49641711246360c25781d20a4`	affected	< c68c4ce72feb6fcccc843eb3baa7af60189ed567
`d19770e5178a4bc49641711246360c25781d20a4`	affected	< ff3c670a1de3a714f5644e37b9446fe7c3299fd3
`d19770e5178a4bc49641711246360c25781d20a4`	affected	< a0701e387b46e2481c05b47f1235b954bfc2af3e

Linux

affected

Version	Status	Constraints
`2.6.24`	affected	—
`0`	unaffected	< 2.6.24
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d19770e5178a4bc49641711246360c25781d20a4,8fbdca4c99f68734e9b6c030973fb61a11bede15)`	affected	code_commit	—
`[d19770e5178a4bc49641711246360c25781d20a4,83540d86d717735b52a43e4ba1b784da5cc2310a)`	affected	code_commit	—
`[d19770e5178a4bc49641711246360c25781d20a4,c68c4ce72feb6fcccc843eb3baa7af60189ed567)`	affected	code_commit	—
`[d19770e5178a4bc49641711246360c25781d20a4,ff3c670a1de3a714f5644e37b9446fe7c3299fd3)`	affected	code_commit	—
`[d19770e5178a4bc49641711246360c25781d20a4,a0701e387b46e2481c05b47f1235b954bfc2af3e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.24`	affected	semver	—
`[0,2.6.24)`	unaffected	semver	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a release that includes the commit adding the ioremap return check (e.g., any kernel following commit 83540d86d717735b52a43e4ba1b784da5cc2310a).
If a kernel upgrade is not yet available, prevent the cx23885 driver from loading by adding "blacklist cx23885" to /etc/modprobe.d/blacklist.conf or unloading it with modprobe -r cx23885.
Restrict access to the PCI device and the driver by ensuring only privileged users can install or enable the cx23885 hardware, and monitor kernel logs for any PCI mapping errors.

Generated by OpenCVE AI on August 13, 2026 at 07:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/6a7636e3d5204fb18fdf1c3f909a3d9d9e24064c
https://git.kernel.org/stable/c/83540d86d717735b52a43e4ba1b784da5cc2310a
https://git.kernel.org/stable/c/8fbdca4c99f68734e9b6c030973fb61a11bede15
https://git.kernel.org/stable/c/9052fec0bb84eace81ac7bad071266052870cdf3
https://git.kernel.org/stable/c/a0701e387b46e2481c05b47f1235b954bfc2af3e
https://git.kernel.org/stable/c/c68c4ce72feb6fcccc843eb3baa7af60189ed567
https://git.kernel.org/stable/c/f58f4b571bd75c78bbf15441086ba0c2830c1aa5
https://git.kernel.org/stable/c/ff3c670a1de3a714f5644e37b9446fe7c3299fd3
https://lore.kernel.org/linux-cve-announce/2026081016-CVE-2026-68226-961f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68226
https://www.cve.org/CVERecord?id=CVE-2026-68226

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6a7636e3d5204fb18fdf1c3f909a3d9d9e24064c https://git.kernel.org/stable/c/9052fec0bb84eace81ac7bad071266052870cdf3 https://git.kernel.org/stable/c/f58f4b571bd75c78bbf15441086ba0c2830c1aa5

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081016-CVE-2026-68226-961f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68226 https://www.cve.org/CVERecord?id=CVE-2026-68226
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Mon, 10 Aug 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: cx23885: add ioremap return check and cleanup Add a check for the return value of pci_ioremap_bar() in cx23885_dev_setup(). If ioremap for BAR0 fails, release the already allocated PCI memory region, decrement the device count, and return -ENODEV. This prevents a potential null pointer dereference and ensures proper cleanup on memory mapping failure.
Title		media: cx23885: add ioremap return check and cleanup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/83540d86d717735b52a43e4ba1b784da5cc2310a https://git.kernel.org/stable/c/8fbdca4c99f68734e9b6c030973fb61a11bede15 https://git.kernel.org/stable/c/a0701e387b46e2481c05b47f1235b954bfc2af3e https://git.kernel.org/stable/c/c68c4ce72feb6fcccc843eb3baa7af60189ed567 https://git.kernel.org/stable/c/ff3c670a1de3a714f5644e37b9446fe7c3299fd3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:00:48.349Z

Updated: 2026-08-19T16:31:56.630Z

Reserved: 2026-07-30T09:28:09.376Z

Link: CVE-2026-68226

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:10.793

Modified: 2026-08-19T17:20:38.407

Link: CVE-2026-68226

Redhat

Severity : Low

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68226 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T07:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object