CVE-2024-39464

What it actually does

Uninitialized list_head member (notifier_entry) in struct v4l2_async_notifier causes NULL pointer dereference when v4l2_async_nf_unregister() is called after a registration failure such as csi2_async_register() returning -ENOTCONN.

Why it matters to the business

Media and video subsystems on affected systems can crash, producing denial-of-service conditions that interrupt camera, capture, or display workloads and require manual recovery or reboot.

How an attack unfolds

An attacker with local access or the ability to influence device-tree / endpoint configuration triggers a notifier registration failure; subsequent unregister operations then walk the uninitialized list_head, dereferencing NULL and crashing the kernel.

How to fix it

Update xorg-server (or the underlying kernel package containing the v4l async fix) to the versions listed: Debian 11 → 2:1.20.11-1+deb11u13, Debian 12 → 2:21.1.7-3+deb12u7, Debian 13 → 2:21.1.11-3. Reboot after installation and verify the notifier initialization change is present.

How to confirm the fix worked

Confirm the running kernel or xorg-server package matches a fixed version, then exercise the failure path (disabled remote endpoint) and ensure no NULL dereference occurs in v4l2_async_nf_unregister().

Typical attack path

1. Obtain local execution or control over a remote endpoint node
2. Force csi2_async_register() or equivalent to fail (e.g., disabled endpoint)
3. Invoke v4l2_async_nf_unregister() on the notifier
4. Trigger NULL dereference and kernel panic

How to detect it

Search kernel logs and dmesg for NULL pointer dereference traces involving v4l2_async_nf_unregister or notifier_entry around the time of media device registration failures.

What your security team should do

• Apply the listed package updates immediately on all Debian 11/12/13 systems exposing v4l/media devices
• Prioritize systems with camera or video capture workloads
• Monitor for kernel oops/panic logs containing v4l2_async after the patch window