CVE-2024-43833

What it actually does

NULL pointer dereference in v4l2_async_create_ancillary_links() when the async notifier is tied to a V4L2 device, making the source sub-device NULL for ancillary links between lens/flash sub-devices.

Why it matters to the business

Local denial of service or kernel crash on systems using V4L2 media devices such as cameras or video capture hardware, with moderate operational disruption across 594 downstream dependents.

How an attack unfolds

An attacker with local access triggers ancillary link creation via a V4L2 device notifier configuration where the sd field is NULL, dereferencing the pointer and crashing the kernel; unrelated threat actor campaigns have targeted similar Linux kernel memory issues.

How to fix it

Apply the upstream kernel fix that adds a non-NULL check for the notifier's sd field in v4l2_async_create_ancillary_links(); for affected pydantic packages update to 1.10.13 or 2.4.0 as applicable.

How to confirm the fix worked

Confirm the source check for notifier->sd != NULL exists in v4l2_async_create_ancillary_links() and test V4L2 async notifier paths with V4L2 device associations do not crash.

Typical attack path

1. Obtain local access to a Linux system with V4L2 media hardware
2. Configure or interact with an async notifier associated with a V4L2 device
3. Trigger creation of ancillary links for lens or flash sub-devices
4. Cause NULL pointer dereference leading to kernel panic

How to detect it

Review kernel logs for NULL pointer dereference oops in v4l2_async_create_ancillary_links or related V4L2 async paths; correlate with media device initialization events.

What your security team should do

• Prioritize kernel updates on systems exposing V4L2 media devices
• Monitor for local privilege or media subsystem crashes
• Review downstream dependents for indirect exposure