CVE-2026-31473
Published: Apr 22, 2026
Modified: May 11, 2026
CVSS v3.1
7.8
Description
In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports. We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_ioctl_reinit() so REINIT is in the same exclusion domain. This keeps request cleanup and queue cancellation from running in parallel for request-capable devices.
| Vendor | Product | Versions |
|---|---|---|
Linux | Linux | affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 - < 331242998a7ade5c2f65e14988901614629f3db5affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 - < 2c685e99efb3b3bd2b78699fba6b1cf321975db0affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 - < 585fd9a2063dacce8b2820f675ef23d5d17434c5affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 - < 1a0d9083c24fbd5d22f7100f09d11e4d696a5f01affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 - < d8549a453d5bdc0a71de66ad47a1106703406a56+3 more versions |
Linux | Linux | affected 4.20unaffected 0 - < 4.20unaffected 5.10.253 - <= 5.10.*unaffected 5.15.203 - <= 5.15.*unaffected 6.1.168 - <= 6.1.*+5 more versions |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now