In the Linux kernel, a race condition exists between the media request reinitialization control operation (MEDIA_REQUEST_IOC_REINIT) and the same driver’s buffer queue management ioctl (VIDIOC_REQBUFS). When these calls are executed concurrently, the cleanup of a request object can collide with the cancellation of the v4l2 buffer queue, resulting in a use‑after‑free condition. This flaw is a classic use‑after‑free bug (CWE‑416) as well as a race condition during resource cleanup (CWE‑364) and can potentially lead to arbitrary code execution or a kernel crash if an attacker can trigger the race.

This issue affects any Linux kernel that implements media request handling for mc and v4l2 instances, i.e. all media request‑capable devices before the fix is applied. No specific version numbers are listed, so systems running unpatched kernels relying on the media and video4linux interfaces are potentially vulnerable.

The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation. Nonetheless, because the flaw requires only local interaction with a media device, a privileged user or a compromised application could intentionally trigger the race. The resulting memory corruption could provide a path to privilege escalation or denial of service. Attacks would likely stem from locally executing code that issues the two ioctls simultaneously or from a malicious driver. The CVSS score is 7.8.