CVE-2026-31599 - Vulnerability Details

- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

Description

In the Linux kernel, the following vulnerability has been resolved:

media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

syzbot reported a general protection fault in vidtv_psi_desc_assign [1].

vidtv_psi_pmt_stream_init() can return NULL on memory allocation
failure, but vidtv_channel_pmt_match_sections() does not check for
this. When tail is NULL, the subsequent call to
vidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL
pointer offset, causing a general protection fault.

Add a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean
up the already-allocated stream chain and return.

[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629
Call Trace:
<TASK>
vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline]
vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479
vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519
vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]
vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239

Published: 2026-04-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference was discovered in the vidtv test driver of the Linux kernel. When the function vidtv_psi_pmt_stream_init() fails to allocate memory, the subsequent call to vidtv_channel_pmt_match_sections() does not check for a NULL result, and attempts to dereference the null pointer, causing a general protection fault. This kernel fault can lead to a system crash if triggered, potentially denying service to applications or a host. The nature of the flaw is a classic null pointer dereference (CWE‑476).

Affected Systems

The issue affects the Linux kernel, particularly the vidtv test driver present in all kernel releases until the fix is applied. No specific version is listed, so any system running the vidtv media test driver is at risk.

Risk and Exploitability

The fault is exploitable only from the local machine because it requires interaction with the vidtv driver; remote exploitation is not supported by the current description. The EPSS score is reported as < 1 %, indicating a very low probability of real-world exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, a local attacker with sufficient privileges to trigger the driver can induce a kernel panic and mount a denial‑of‑service attack.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f90cf6079bf67988f8b1ad1ade70fc89d0080905`	affected	< b7efb4c94797c504a1c678edb48c2aa311d3309f
`f90cf6079bf67988f8b1ad1ade70fc89d0080905`	affected	< e589de36da106ef739ba98f66f5a5c2023370706
`f90cf6079bf67988f8b1ad1ade70fc89d0080905`	affected	< 2dff11fb5098ae453651f8f77e94ad499c078022
`f90cf6079bf67988f8b1ad1ade70fc89d0080905`	affected	< b832cfd516b8504e95884622cee60bf9a39b7945
`f90cf6079bf67988f8b1ad1ade70fc89d0080905`	affected	< 07c1e474cf9acf777f09d14a8f8dfcef5b84e46f
`f90cf6079bf67988f8b1ad1ade70fc89d0080905`	affected	< f8e1fc918a9fe67103bcda01d20d745f264d00a7

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`6.6.136`	unaffected	≤ 6.6.*
`6.12.83`	unaffected	≤ 6.12.*
`6.18.24`	unaffected	≤ 6.18.*
`6.19.14`	unaffected	≤ 6.19.*
`7.0.1`	unaffected	≤ 7.0.*
`7.1-rc1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f90cf6079bf67988f8b1ad1ade70fc89d0080905,b7efb4c94797c504a1c678edb48c2aa311d3309f)`	affected	code_commit	—
`[f90cf6079bf67988f8b1ad1ade70fc89d0080905,e589de36da106ef739ba98f66f5a5c2023370706)`	affected	code_commit	—
`[f90cf6079bf67988f8b1ad1ade70fc89d0080905,2dff11fb5098ae453651f8f77e94ad499c078022)`	affected	code_commit	—
`[f90cf6079bf67988f8b1ad1ade70fc89d0080905,b832cfd516b8504e95884622cee60bf9a39b7945)`	affected	code_commit	—
`[f90cf6079bf67988f8b1ad1ade70fc89d0080905,07c1e474cf9acf777f09d14a8f8dfcef5b84e46f)`	affected	code_commit	—
`[f90cf6079bf67988f8b1ad1ade70fc89d0080905,f8e1fc918a9fe67103bcda01d20d745f264d00a7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	generic	—
`[0,5.10)`	unaffected	generic	—
`[6.6.0,6.7.0)`	unaffected	semver	—
`[6.12.0,6.13.0)`	unaffected	semver	—
`[6.18.0,6.19.0)`	unaffected	semver	—
`[6.19.0,6.20.0)`	unaffected	semver	—
`[7.0.0,7.1.0)`	unaffected	semver	—
`[7.1-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest stable kernel update that contains the vidtv null pointer dereference patch
Disable or unload the vidtv test driver if it is not required for your environment
Restrict local user privileges that can interact with the driver to mitigate potential denial‑of‑service

Generated by OpenCVE AI on April 30, 2026 at 04:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6238-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/07c1e474cf9acf777f09d14a8f8dfcef5b84e46f
https://git.kernel.org/stable/c/2dff11fb5098ae453651f8f77e94ad499c078022
https://git.kernel.org/stable/c/b7efb4c94797c504a1c678edb48c2aa311d3309f
https://git.kernel.org/stable/c/b832cfd516b8504e95884622cee60bf9a39b7945
https://git.kernel.org/stable/c/e589de36da106ef739ba98f66f5a5c2023370706
https://git.kernel.org/stable/c/f8e1fc918a9fe67103bcda01d20d745f264d00a7
https://lore.kernel.org/linux-cve-announce/2026042418-CVE-2026-31599-b2c6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31599
https://www.cve.org/CVERecord?id=CVE-2026-31599

History

Wed, 29 Apr 2026 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b7efb4c94797c504a1c678edb48c2aa311d3309f

Mon, 27 Apr 2026 11:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/f8e1fc918a9fe67103bcda01d20d745f264d00a7

Sat, 25 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026042418-CVE-2026-31599-b2c6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31599 https://www.cve.org/CVERecord?id=CVE-2026-31599

Fri, 24 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections syzbot reported a general protection fault in vidtv_psi_desc_assign [1]. vidtv_psi_pmt_stream_init() can return NULL on memory allocation failure, but vidtv_channel_pmt_match_sections() does not check for this. When tail is NULL, the subsequent call to vidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL pointer offset, causing a general protection fault. Add a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean up the already-allocated stream chain and return. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629 Call Trace: <TASK> vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline] vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479 vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline] vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239
Title		media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07c1e474cf9acf777f09d14a8f8dfcef5b84e46f https://git.kernel.org/stable/c/2dff11fb5098ae453651f8f77e94ad499c078022 https://git.kernel.org/stable/c/b832cfd516b8504e95884622cee60bf9a39b7945 https://git.kernel.org/stable/c/e589de36da106ef739ba98f66f5a5c2023370706

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-24T14:42:23.961Z

Updated: 2026-05-11T22:11:54.382Z

Reserved: 2026-03-09T15:48:24.121Z

Link: CVE-2026-31599

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-24T15:16:38.777

Modified: 2026-04-29T20:12:57.060

Link: CVE-2026-31599

Redhat

Severity :

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31599 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-30T04:15:26Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object