In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: fix nfeeds state corruption on start_streaming failure
syzbot reported a memory leak in vidtv_psi_service_desc_init [1].
When vidtv_start_streaming() fails inside vidtv_start_feed(), the
nfeeds counter is left incremented even though no feed was actually
started. This corrupts the driver state: subsequent start_feed calls
see nfeeds > 1 and skip starting the mux, while stop_feed calls
eventually try to stop a non-existent stream.
This state corruption can also lead to memory leaks, since the mux
and channel resources may be partially allocated during a failed
start_streaming but never cleaned up, as the stop path finds
dvb->streaming == false and returns early.
Fix by decrementing nfeeds back when start_streaming fails, keeping
the counter in sync with the actual number of active feeds.
[1]
BUG: memory leak
unreferenced object 0xffff888145b50820 (size 32):
comm "syz.0.17", pid 6068, jiffies 4294944486
backtrace (crc 90a0c7d4):
vidtv_psi_service_desc_init+0x74/0x1b0 drivers/media/test-drivers/vidtv/vidtv_psi.c:288
vidtv_channel_s302m_init+0xb1/0x2a0 drivers/media/test-drivers/vidtv/vidtv_channel.c:83
vidtv_channels_init+0x1b/0x40 drivers/media/test-drivers/vidtv/vidtv_channel.c:524
vidtv_mux_init+0x516/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:518
vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]
vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239
References
Configurations
Configuration 1 (hide)
|
History
28 Apr 2026, 20:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/17cb7957c979529cc98ff57f7ac331532f1f7c83 - Patch | |
| References | () https://git.kernel.org/stable/c/25f19e476ab15defe698504212899fdb9f7cd61b - Patch | |
| References | () https://git.kernel.org/stable/c/4bf95f797edd63c93330eafb6d6e670982344b9b - Patch | |
| References | () https://git.kernel.org/stable/c/83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd - Patch | |
| References | () https://git.kernel.org/stable/c/98c22210aeadce67d9d20059f0dbbd01ba7fdbba - Patch | |
| References | () https://git.kernel.org/stable/c/a0e5a598fe9a4612b852406b51153b881592aede - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CWE | CWE-401 | |
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Apr 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-24 15:16
Updated : 2026-04-28 20:47
NVD link : CVE-2026-31585
Mitre link : CVE-2026-31585
CVE.ORG link : CVE-2026-31585
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-401
Missing Release of Memory after Effective Lifetime