{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31473", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.098Z", "datePublished": "2026-04-22T13:54:00.970Z", "dateUpdated": "2026-08-05T12:22:51.779Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:51.779Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex\n\nMEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)\nqueue teardown paths. This can race request object cleanup against vb2\nqueue cancellation and lead to use-after-free reports.\n\nWe already serialize request queueing against STREAMON/OFF with\nreq_queue_mutex. Extend that serialization to REQBUFS, and also take\nthe same mutex in media_request_ioctl_reinit() so REINIT is in the\nsame exclusion domain.\n\nThis keeps request cleanup and queue cancellation from running in\nparallel for request-capable devices." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable paths are reached through local `ioctl()` calls on media/video device file descriptors: `MEDIA_REQUEST_IOC_REINIT` on a request fd and `VIDIOC_REQBUFS(0)` on a V4L2 video fd. The affected code is not reachable directly from network packets or adjacent/physical protocol input.\nAC:L - This is a race, but an attacker controls both racing operations by issuing concurrent ioctls from local threads or processes. No condition beyond access to a request-capable media device is required.\nPR:L - The kernel path has no capability or admin check; the attacker only needs ordinary local ability to open the relevant `/dev/media*` and `/dev/video*` nodes. This is basic local privilege rather than real root/admin privilege.\nUI:N - Once the attacker can run local code and open the device nodes, exploitation is driven entirely by attacker-issued ioctls. No separate victim action is required.\nS:U - The vulnerability corrupts kernel media/videobuf2 request state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is a use-after-free involving media request objects and vb2 buffer/request state during concurrent cleanup and queue teardown. Per kernel CVSS guidance, UAF memory corruption can be leveraged for kernel memory disclosure, so confidentiality impact is high.\nI:H - The race can corrupt freed kernel heap objects and request/buffer state, giving a plausible path to control-flow or arbitrary-write style exploitation. Per kernel CVSS guidance, use-after-free memory corruption warrants high integrity impact.\nA:H - The fix commit explicitly addresses use-after-free reports, and such kernel UAFs can reliably trigger KASAN reports, oopses, or panics. This is a high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/mc/mc-request.c", "drivers/media/v4l2-core/v4l2-ioctl.c" ], "versions": [ { "version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9", "lessThan": "331242998a7ade5c2f65e14988901614629f3db5", "status": "affected", "versionType": "git" }, { "version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9", "lessThan": "2c685e99efb3b3bd2b78699fba6b1cf321975db0", "status": "affected", "versionType": "git" }, { "version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9", "lessThan": "585fd9a2063dacce8b2820f675ef23d5d17434c5", "status": "affected", "versionType": "git" }, { "version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9", "lessThan": "1a0d9083c24fbd5d22f7100f09d11e4d696a5f01", "status": "affected", "versionType": "git" }, { "version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9", "lessThan": "d8549a453d5bdc0a71de66ad47a1106703406a56", "status": "affected", "versionType": "git" }, { "version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9", "lessThan": "72b9e81e0203f03c40f3adb457f55bd4c8eb112d", "status": "affected", "versionType": "git" }, { "version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9", "lessThan": "cf2023e84f0888f96f4b65dc0804e7f3651969c1", "status": "affected", "versionType": "git" }, { "version": "6093d3002eabd7c2913d97f1d1f4ce34b072acf9", "lessThan": "bef4f4a88b73e4cc550d25f665b8a9952af22773", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/mc/mc-request.c", "drivers/media/v4l2-core/v4l2-ioctl.c" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.253" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.131" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.80" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.19.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5" }, { "url": "https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0" }, { "url": "https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5" }, { "url": "https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01" }, { "url": "https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56" }, { "url": "https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d" }, { "url": "https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1" }, { "url": "https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773" } ], "title": "media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex", "x_generator": { "engine": "bippy-1.2.0" } } } }