CVE-2026-46222: Linux Rockchip RKCam Driver Null Pointer Dereference

Technical summary

CVE-2026-46222 is a null pointer dereference vulnerability in the rkcif media subsystem (drivers/media/platform/rockchip/rkcif/). The rkcif_interface_enable_streams() function fails to validate that required media pads have connected devices before dereferencing them during stream initialization. The missing MUST_CONNECT flag on pad definitions permits invalid pipeline states where internal function calls attempt to access hardware state through null pointers. The crash occurs deep in the V4L2 subdevice abstraction when vb2_core_streamon() triggers the enable_streams path on an incompletely configured capture interface.

Business impact

Availability impact is localized to affected Rockchip SoC systems running vulnerable kernels. A local attacker or unprivileged user can reliably crash the video subsystem or entire kernel, disrupting any service relying on camera input (video conferencing, surveillance systems, embedded vision applications on Rockchip boards). Recovery requires a restart. No data corruption or privilege escalation is possible; the threat model is denial of service on dedicated video processing systems.

Affected systems

Linux kernel versions containing the vulnerable rkcif driver, primarily deployed in embedded and consumer devices using Rockchip SoCs (RK3288, RK3399, RK3568, and related variants). Typical deployments include single-board computers, embedded video appliances, automotive infotainment systems, and IoT edge devices. Desktop and server Linux distributions are largely unaffected unless explicitly running Rockchip-specific drivers.

Exploitability

Exploitability is straightforward but scoped to local attackers with user-level login capability. No special privileges, network access, or user interaction is required beyond calling standard V4L2 ioctl commands (VIDIOC_STREAMON) on a misconfigured or disconnected camera pipeline. The attack surface is limited to systems with active rkcif hardware; the flaw cannot be remotely triggered. Automated fuzzing or intentional misconfiguration of media pipelines reliably reproduces the crash within seconds.

Remediation

Apply the Linux kernel patch that adds the MUST_CONNECT flag to rkcif media pads. This enforces validation of connected devices at pipeline configuration time, preventing invalid states that lead to null dereference. The fix is a small, low-risk change to pad attribute definitions. Coordinate patching through your Linux distributor or apply directly from upstream kernel repositories once released.

Patch guidance

Monitor your Linux distributor (Debian, Ubuntu, Fedora, RHEL, etc.) or Rockchip SoC vendor for updated kernel packages addressing CVE-2026-46222. If running a custom or vendor-supplied kernel on Rockchip hardware, verify the fix is included by checking the rkcif driver source for MUST_CONNECT flags on all media pads. Rebuild and redeploy kernel updates according to your change management process. Test video streaming functionality post-patch to confirm normal operation.

Detection guidance

Enable kernel logging and monitor system logs for NULL pointer dereference messages originating from rkcif_interface_enable_streams(). Watch for repeated video subsystem crashes or STREAMON ioctl failures in userspace applications (gstreamer, ffmpeg, V4L2 tools). On production edge/embedded devices, correlate video feed outages with kernel crash signatures. Intrusion detection is not applicable; this is a local stability issue rather than a security breach indicator.

Why prioritize this

Although the CVSS score is moderate (5.5), prioritization should consider deployment context. Systems where camera input is mission-critical (surveillance, automotive, industrial vision) warrant urgent patching. General-purpose Linux desktops and servers face negligible risk unless Rockchip hardware is explicitly used. IoT and embedded Rockchip deployments should patch within standard SLA windows; the barrier to exploitation is low, but impact is contained to availability.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects the denial-of-service severity balanced against local-only attack vector and low privilege requirement (user-level login). The AV:L/AC:L/PR:L/UI:N profile indicates any logged-in user can trivially trigger a kernel crash. The complete absence of confidentiality and integrity impact (C:N/I:N) and availability impact limited to the affected subsystem (S:U) prevents a higher score. Real-world risk is lower on general compute systems but higher on single-purpose embedded devices.

Frequently asked questions