CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
In the Linux kernel, the following vulnerability has been resolved:
media: mc, v4l2: serialize REINIT and REQBUFS with reqqueuemutex
MEDIAREQUESTIOCREINIT can run concurrently with VIDIOCREQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports.
We already serialize request queueing against STREAMON/OFF with reqqueuemutex. Extend that serialization to REQBUFS, and also take the same mutex in mediarequestioctlreinit() so REINIT is in the same exclusion domain.
This keeps request cleanup and queue cancellation from running in parallel for request-capable devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.134.1-2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In media_request_ioctl_reinit(), take req_queue_mutex so MEDIA_REQUEST_IOC_REINIT and VIDIOC_REQBUFS(0) queue teardown execute in the same exclusion domain and cannot race.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31473?
CVE-2026-31473 has a high severity rating due to its potential impact on system stability and security.
How do I fix CVE-2026-31473?
To fix CVE-2026-31473, update your Linux kernel to a version that has addressed this vulnerability.
Which Linux kernel versions are affected by CVE-2026-31473?
CVE-2026-31473 affects Linux kernel versions from 4.20.1 up to 5.10.253 and versions across multiple ranges until 7.0-rc7.
What is the impact of CVE-2026-31473 on system performance?
CVE-2026-31473 could lead to performance degradation due to potential race conditions in media request handling.
Is CVE-2026-31473 exploitable remotely?
Yes, CVE-2026-31473 can potentially be exploited remotely if an attacker gains access to the media interface on the affected system.