CVE Explorer

CVE-2026-31473

In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports. We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_io

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:fed8a100bc877cd15dc425519ea0396971737391e4f13baeb672d239e7bd2343

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"331242998a7ade5c2f65e14988901614629f3db5","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"2c685e99efb3b3bd2b78699fba6b1cf321975db0","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"585fd9a2063dacce8b2820f675ef23d5d17434c5","status"…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","versi…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:78e08aee74884e87ae892da7802cb5b665bfb43727f85c8ed0090ffd88e3fff3 · sha256:963debd6431d551d… · /containers/cna/references/4

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer