CVE-2026-46222 media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads

Medium 5.5 Published 28 May 2026 Updated 14 Jun 2026

A missing connection check in the Rockchip CIF driver causes a kernel null pointer dereference, leading to a system crash when streaming is enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-46222?

CVE-2026-46222 is a medium-severity vulnerability in Linux kernel, published on 28 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads

The pads missed checks for connected devices which may a null dereference when the stream is enabled.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 pc : rkcif_interface_enable_streams+0x48/0xf0 lr : rkcif_interface_enable_streams+0x44/0xf0 Call trace: rkcif_interface_enable_streams+0x48/0xf0 v4l2_subdev_enable_streams+0x26c/0x3f0 rkcif_stream_start_streaming+0x140/0x278 vb2_start_streaming+0x74/0x188 vb2_core_streamon+0xe0/0x1d8 vb2_ioctl_streamon+0x60/0xa8 v4l_streamon+0x2c/0x40 __video_do_ioctl+0x34c/0x400 video_usercopy+0x2d0/0x800 video_ioctl2+0x20/0x60 v4l2_ioctl+0x48/0x78

Weakness: CWE-476

Which versions are affected by CVE-2026-46222?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-46222?

Apply the vendor's patch.

Is CVE-2026-46222 being exploited?

There is no known exploitation of CVE-2026-46222 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-46222, GHSA-wprv-4wq2-c8jp, UBUNTU-CVE-2026-46222.