CVE-2026-46310: Linux Renesas VSP1 NULL Pointer Dereference on Module Unload

Technical summary

CVE-2026-46310 is a NULL pointer dereference in the Renesas VSP1 (Video Signal Processor) driver within the Linux kernel media subsystem. During module unload on generation 4 hardware, the cleanup routine incorrectly invokes vsp1_drm_cleanup() instead of the appropriate vsp1_vspx_cleanup() function. The root cause is a mismatch between initialization and cleanup logic: the init code properly checks IP version and calls the correct function, but the unload path does not. This inconsistency leaves a NULL or invalid pointer in memory, which is dereferenced during cleanup, causing a kernel panic. The vulnerability is classified as CWE-476 (NULL Pointer Dereference).

Business impact

This vulnerability primarily affects system availability and uptime. Affected systems will experience kernel crashes when unloading the VSP1 driver module, disrupting video processing workloads and requiring manual intervention to restore service. For organizations using Renesas-based SoCs with VSP1 hardware—particularly in automotive, embedded systems, or specialized video processing roles—unplanned downtime can impact critical operations. The local-only attack vector limits exposure to users with direct system access, reducing the blast radius compared to remote vulnerabilities.

Affected systems

The vulnerability affects the Linux kernel with specific impact on systems using Renesas VSP1 hardware, particularly generation 4 variants. Any distribution or embedded Linux system shipping the vulnerable kernel code and supporting VSP1 module unload is affected. This includes automotive platforms, embedded media servers, and specialized video processing devices built on Renesas SoCs. The exact kernel versions containing this flaw should be verified against vendor release notes and the Linux kernel upstream repository.

Exploitability

Exploitation requires local system access and the ability to unload kernel modules, typically restricted to privileged users (root or those with CAP_SYS_MODULE capability). The vulnerability is triggered passively during normal module cleanup—no additional steps or user interaction are needed once unload is initiated. Accidental triggering is more likely than deliberate exploitation, as any legitimate module unload sequence will crash the kernel. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects local access and high availability impact with no complexity required.

Remediation

Remediation requires a kernel update that aligns the module unload cleanup path with the initialization logic. The fix involves adding an IP version check in the cleanup code to conditionally call either vsp1_drm_cleanup() or vsp1_vspx_cleanup(), mirroring the approach used during module initialization. This ensures the correct cleanup function is invoked for each hardware generation, preventing the NULL pointer dereference. Users should check their Linux distribution's kernel security advisories for patched versions.

Patch guidance

Obtain and install a kernel update from your Linux distribution that includes the fix for CVE-2026-46310. For upstream Linux kernel users, verify that your kernel version includes the commit resolving this issue by checking the Linux kernel mailing list or upstream repository. Kernel rebuild and reboot are required to apply the patch. Organizations should validate patch deployment in a controlled environment before rolling out to production systems, particularly where VSP1 module unload events are frequent. Consult your vendor's security advisory for specific patched kernel versions and deployment timelines.

Detection guidance

Monitor system logs and kernel panic dumps for crashes occurring during VSP1 module unload operations. Kernel messages will typically show a NULL pointer dereference in vsp1-related code paths. Implement automated log aggregation and alerting on kernel oops or panic messages mentioning 'vsp1' or 'renesas'. On systems where VSP1 modules are regularly loaded and unloaded, enable kernel crash reporting (kdump or similar) to capture detailed state. Security information and event management (SIEM) systems can be configured to flag unexpected kernel crashes as availability anomalies.

Why prioritize this

While this vulnerability carries a MEDIUM CVSS score (5.5), it merits prioritization for systems actively using Renesas VSP1 hardware because availability impact is severe and predictable. The vulnerability is not actively exploited in the wild (KEV status: false) and requires local access, reducing urgency for internet-facing systems. However, embedded and specialized systems dependent on VSP1 for video processing should prioritize patching to prevent operational disruptions. For general-purpose Linux servers without VSP1 hardware, this is a lower-priority patch.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector (AV:L) with low complexity (AC:L), requiring low privilege (PR:L), no user interaction (UI:N), and scoped impact limited to the affected system (S:U). The vulnerability has no confidentiality or integrity impact (C:N/I:N) but does cause high availability impact (A:H) through kernel crash. The score appropriately captures the severity for local users while acknowledging the restricted attack surface. However, for Renesas VSP1-dependent systems, the practical impact on business continuity may be higher than the numerical score suggests.

Frequently asked questions