CVE-2026-68226

What it actually does

Missing return-value check on pci_ioremap_bar() in cx23885_dev_setup() allows a subsequent null-pointer dereference when BAR0 mapping fails, resulting in kernel memory corruption.

Why it matters to the business

On systems using the cx23885 driver, a failed memory-mapping operation can crash the kernel, causing denial of service and potential loss of video-capture functionality; the low EPSS score indicates limited real-world exploitability.

How an attack unfolds

An attacker with local access forces pci_ioremap_bar() to fail (for example through memory pressure or driver reload) so that the subsequent dereference of the unchecked return value triggers a kernel panic or memory corruption.

How to fix it

Update the Linux kernel to a version containing the fix that adds the pci_ioremap_bar() return-value check, releases the PCI region, decrements the device count, and returns -ENODEV on failure.

How to confirm the fix worked

Confirm the source contains the added NULL check after pci_ioremap_bar(), recompile the cx23885 module, load it on hardware, and verify that a forced mapping failure returns -ENODEV without dereferencing NULL.

Typical attack path

1. Obtain local access to a system containing cx23885 hardware
2. Trigger conditions that cause pci_ioremap_bar(BAR0) to return NULL
3. Allow the unchecked pointer to be dereferenced inside cx23885_dev_setup()
4. Observe kernel oops or system crash

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for cx23885 oops or null-pointer dereference messages around the time of driver initialization; no external network indicators exist.

What your security team should do

• Apply the upstream kernel patch or distribution update that resolves the missing ioremap check
• Monitor kernel logs for cx23885-related oops or null dereference warnings
• Restrict local access to systems with cx23885 hardware until patched