CVE-2026-68225

A flaw was found in the Linux kernel's media I2C Alvium driver. The alvium_ctrl_init function, responsible for initializing controls, does not properly check if pointers are valid before using them. This can lead to the system attempting to write data to an invalid memory location, which could allow a local attacker to cause a system crash and result in a denial of service.

This vulnerability is rated with a Low severity because exploitation requires local access alongside specialized Alvium camera hardware, limiting the blast radius to a system crash without confidentiality or integrity loss. Red Hat Enterprise Linux kernels do not include the vulnerable driver code, so default enterprise environments are not exposed to this flaw. In addition, triggering the unvalidated pointer access requires interacting with the specific camera sensor during initialization.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.