CVE-2026-46205: staging: media: atomisp: Disallow all private IOCTLs

Synopsis

This is a privilege-escalation vulnerability in the Linux kernel's staging atomisp (Intel Atom ISP) media driver. A local attacker with a low-privilege account can invoke private IOCTL commands that bypass expected access controls, reaching unsafe kernel code paths. Successful exploitation gives the attacker full read, write, and crash capability over the affected kernel, enabling data theft, data tampering, or a complete system denial of service. Patched-image rebuilds at the fix versions (6.6.140, 6.12.90, 6.18.32, and the associated upstream commits) are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to invoke the vulnerable IOCTL interface; no elevated or administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  Exploit reliability is high: no race conditions, memory-layout dependencies, or other environmental factors need to be satisfied for the attack to succeed.

Blast Radius

• A successful attacker reads arbitrary kernel memory, exposing stored credentials, session tokens, and sensitive process data from other users or containers on the host.
• The attacker writes to arbitrary kernel memory, allowing modification of security controls, process credentials, or persisted data on attached storage.
• The attacker can crash the kernel entirely, taking down all workloads running on the affected node and causing a full denial of service.