CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
In the Linux kernel, the following vulnerability has been resolved:
media: mc, v4l2: serialize REINIT and REQBUFS with reqqueuemutex
MEDIAREQUESTIOCREINIT can run concurrently with VIDIOCREQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports.
We already serialize request queueing against STREAMON/OFF with reqqueuemutex. Extend that serialization to REQBUFS, and also take the same mutex in mediarequestioctlreinit() so REINIT is in the same exclusion domain.
This keeps request cleanup and queue cancellation from running in parallel for request-capable devices.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31473?
CVE-2026-31473 has a high severity rating due to its potential impact on system stability and security.
How do I fix CVE-2026-31473?
To fix CVE-2026-31473, update your Linux kernel to a version that has addressed this vulnerability.
Which Linux kernel versions are affected by CVE-2026-31473?
CVE-2026-31473 affects Linux kernel versions from 4.20.1 up to 5.10.253 and versions across multiple ranges until 7.0-rc7.
What is the impact of CVE-2026-31473 on system performance?
CVE-2026-31473 could lead to performance degradation due to potential race conditions in media request handling.
Is CVE-2026-31473 exploitable remotely?
Yes, CVE-2026-31473 can potentially be exploited remotely if an attacker gains access to the media interface on the affected system.