Description
In the Linux kernel, the following vulnerability has been resolved:

media: vidtv: fix pass-by-value structs causing MSAN warnings

vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their
argument structs by value, causing MSAN to report uninit-value warnings.
While only vidtv_ts_null_write_into() has triggered a report so far,
both functions share the same issue.

Fix by passing both structs by const pointer instead, avoiding the
stack copy of the struct along with its MSAN shadow and origin metadata.
The functions do not modify the structs, which is enforced by the const
qualifier.
Published: 2026-05-02
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In the Linux kernel video driver vidtv, two functions previously copied their input structures by value, which led to Microsoft Sanitizer (MSAN) reporting uninitialized‑value warnings. This change replaces the value copies with const pointers, eliminating the unnecessary stack copy and its MSAN shadow data. Although the patch modifies function parameters, it is inferred from the description that the control flow or behavior of the driver is not altered, and no new execution paths are introduced.

Affected Systems

All mainline Linux kernels that incorporate the vidtv driver before the inclusion of this patch are affected. The patch does not target a particular vendor's distribution and therefore applies broadly to any kernel build using the affected driver code. Version information is not provided, so any kernel older than the commit that changes the function signatures should be identified and updated.

Risk and Exploitability

The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, indicating a very low probability of exploitation. Because the issue only causes development‑time diagnostics and does not compromise confidentiality, integrity, or availability, the overall security risk is effectively negligible.

Generated by OpenCVE AI on May 4, 2026 at 16:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a Linux kernel release that includes the vidtv driver fix, which changes struct passing to const pointers.
  • If using a custom bootable image or a distribution that lags, rebuild the media driver modules from source that incorporates the commit.
  • For environments where MSAN is employed during testing, filter or ignore the uninitialized‑value reports that originated from these functions until the kernel provides the official patch.

Generated by OpenCVE AI on May 4, 2026 at 16:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 04 May 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-457

Mon, 04 May 2026 12:15:00 +0000


Sat, 02 May 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-457

Sat, 02 May 2026 06:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix pass-by-value structs causing MSAN warnings vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their argument structs by value, causing MSAN to report uninit-value warnings. While only vidtv_ts_null_write_into() has triggered a report so far, both functions share the same issue. Fix by passing both structs by const pointer instead, avoiding the stack copy of the struct along with its MSAN shadow and origin metadata. The functions do not modify the structs, which is enforced by the const qualifier.
Title media: vidtv: fix pass-by-value structs causing MSAN warnings
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-11T22:16:53.951Z

Reserved: 2026-05-01T14:12:55.981Z

Link: CVE-2026-43058

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-05-02T07:16:20.830

Modified: 2026-05-06T13:08:07.970

Link: CVE-2026-43058

cve-icon Redhat

Severity :

Publid Date: 2026-05-02T00:00:00Z

Links: CVE-2026-43058 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-04T17:00:04Z

Weaknesses