{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31599", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.121Z", "datePublished": "2026-04-24T14:42:23.961Z", "dateUpdated": "2026-06-14T17:42:40.045Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T17:42:40.045Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections\n\nsyzbot reported a general protection fault in vidtv_psi_desc_assign [1].\n\nvidtv_psi_pmt_stream_init() can return NULL on memory allocation\nfailure, but vidtv_channel_pmt_match_sections() does not check for\nthis. When tail is NULL, the subsequent call to\nvidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL\npointer offset, causing a general protection fault.\n\nAdd a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean\nup the already-allocated stream chain and return.\n\n[1]\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629\nCall Trace:\n \n vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline]\n vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479\n vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519\n vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]\n vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239" } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/test-drivers/vidtv/vidtv_channel.c" ], "versions": [ { "version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905", "lessThan": "54e18a23e62e81b8335cec3e8e9c5cb33fd88665", "status": "affected", "versionType": "git" }, { "version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905", "lessThan": "5c986b77200b5ea754ba6636deacc7e0942fec9b", "status": "affected", "versionType": "git" }, { "version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905", "lessThan": "93d9e747a9e8a5ca9e3c5e37dcff76b40399139f", "status": "affected", "versionType": "git" }, { "version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905", "lessThan": "b7efb4c94797c504a1c678edb48c2aa311d3309f", "status": "affected", "versionType": "git" }, { "version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905", "lessThan": "e589de36da106ef739ba98f66f5a5c2023370706", "status": "affected", "versionType": "git" }, { "version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905", "lessThan": "2dff11fb5098ae453651f8f77e94ad499c078022", "status": "affected", "versionType": "git" }, { "version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905", "lessThan": "b832cfd516b8504e95884622cee60bf9a39b7945", "status": "affected", "versionType": "git" }, { "version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905", "lessThan": "07c1e474cf9acf777f09d14a8f8dfcef5b84e46f", "status": "affected", "versionType": "git" }, { "version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905", "lessThan": "f8e1fc918a9fe67103bcda01d20d745f264d00a7", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/test-drivers/vidtv/vidtv_channel.c" ], "versions": [ { "version": "5.10", "status": "affected" }, { "version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.1", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.258" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.209" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.175" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.136" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.19.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.0.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/54e18a23e62e81b8335cec3e8e9c5cb33fd88665" }, { "url": "https://git.kernel.org/stable/c/5c986b77200b5ea754ba6636deacc7e0942fec9b" }, { "url": "https://git.kernel.org/stable/c/93d9e747a9e8a5ca9e3c5e37dcff76b40399139f" }, { "url": "https://git.kernel.org/stable/c/b7efb4c94797c504a1c678edb48c2aa311d3309f" }, { "url": "https://git.kernel.org/stable/c/e589de36da106ef739ba98f66f5a5c2023370706" }, { "url": "https://git.kernel.org/stable/c/2dff11fb5098ae453651f8f77e94ad499c078022" }, { "url": "https://git.kernel.org/stable/c/b832cfd516b8504e95884622cee60bf9a39b7945" }, { "url": "https://git.kernel.org/stable/c/07c1e474cf9acf777f09d14a8f8dfcef5b84e46f" }, { "url": "https://git.kernel.org/stable/c/f8e1fc918a9fe67103bcda01d20d745f264d00a7" } ], "title": "media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections", "x_generator": { "engine": "bippy-1.2.0" } } } }