CVE-2026-31473

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31473
In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports. We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_ioctl_reinit() so REINIT is in the same exclusion domain. This keeps request cleanup and queue cancellation from running in parallel for request-capable devices.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01 Patch
https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0 Patch
https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5 Patch
https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5 Patch
https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d Patch
https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773 Patch
https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1 Patch
https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
History

27 Apr 2026, 23:27

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01 - () https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01 - Patch
References () https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0 - () https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0 - Patch
References () https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5 - () https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5 - Patch
References () https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5 - () https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5 - Patch
References () https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d - () https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d - Patch
References () https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773 - () https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773 - Patch
References () https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1 - () https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1 - Patch
References () https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56 - () https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56 - Patch
First Time Linux
Linux linux Kernel
CWE CWE-416
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*

27 Apr 2026, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

22 Apr 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-22 14:16

Updated : 2026-04-27 23:27

NVD link : CVE-2026-31473

Mitre link : CVE-2026-31473

CVE.ORG link : CVE-2026-31473

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free