CVE-2023-52459

What it actually does

Duplicate list_del() call on the same v4l2_async_notifier entry in the Linux kernel media subsystem causes list corruption (LIST_POISON1) or subsequent NULL pointer dereference when CONFIG_DEBUG_LIST is disabled.

Why it matters to the business

Kernel panic or crash on systems using Video4Linux devices can produce denial of service for media capture, cameras, or TV tuners, forcing reboots and interrupting workloads that rely on video hardware.

How an attack unfolds

A local attacker loads or triggers a v4l2 driver that registers an async subdevice, causing the notifier helper to perform the first list_del and the duplicated call site to execute the second, corrupting the list and leading to a crash on next access.

How to fix it

Upgrade the Linux kernel to a version containing commit b7062628caeaec90e8f691ebab2d70f31b7b6b91 or later; rebuild and reboot with the fixed kernel. Disable unnecessary v4l2 drivers until patched if immediate update is not feasible.

How to confirm the fix worked

Confirm kernel source contains the listed commit or that the duplicated list_del line has been removed; boot the updated kernel and exercise v4l2 async registration paths without triggering list corruption warnings.

Typical attack path

1. Obtain local shell or userland execution on a Linux system with Video4Linux support
2. Load or exercise a v4l2 driver that uses async subdevice registration
3. Trigger the code path containing the duplicated list_del call
4. Observe kernel warning or oops resulting in crash or reboot

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for "list_del corruption" or "LIST_POISON1" messages around v4l2 or media subsystem activity; correlate with process crashes or spontaneous reboots on systems with video4linux drivers loaded.

• list_del corruption
• LIST_POISON1
• v4l2_async
• media: v4l: async

What your security team should do

• Apply the fixed kernel commit to all affected distributions as soon as packages are available
• Prioritize systems that expose video capture hardware or run media workloads
• Monitor vendor kernel update channels for backports to supported LTS branches
• Temporarily restrict unprivileged module loading if the exposure window is long