CVE-2026-53382: media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: fix NULL pointer dereference in vidtvmuxpushsi
syzbot reported a general protection fault in vidtvpsitspsiwriteinto [1].
vidtvmuxgetpidctx() can return NULL, but vidtvmuxpushsi() does not check for this before dereferencing the returned pointer to access the continuity counter. This leads to a general protection fault when accessing a near-NULL address.
The root cause is that vidtvmuxpidctxinit() does not check the return value of vidtvmuxcreatepidctxonce() for PMT section PIDs. If the allocation fails, the PID context is never created, but init returns success. The subsequent vidtvmuxpushsi() call then gets NULL from vidtvmuxgetpidctx() and crashes.
Fix both the root cause (add error check in vidtvmuxpidctxinit for PMT PIDs) and add defensive NULL checks in vidtvmuxpushsi for all vidtvmuxgetpidctx() calls.
[1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: events vidtvmuxtick RIP: 0010:vidtvpsitspsiwriteinto+0x54a/0xbc0 drivers/media/test-drivers/vidtv/vidtvpsi.c:197 Call Trace: <TASK> vidtvpsitableheaderwriteinto drivers/media/test-drivers/vidtv/vidtvpsi.c:799 [inline] vidtvpsipmtwriteinto+0x3b2/0xa70 drivers/media/test-drivers/vidtv/vidtvpsi.c:1231 vidtvmuxpushsi+0x932/0xe80 drivers/media/test-drivers/vidtv/vidtvmux.c:196 vidtvmuxtick+0xe9b/0x1480 drivers/media/test-drivers/vidtv/vidtvmux.c:408
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Configuration
In vidtv_mux_pid_ctx_init(), add an error check for allocation failure so that, if PID context allocation fails and vidtv_mux_get_pid_ctx() would return NULL, subsequent code does not proceed with a non-existent PID context.
Linux kernel (drivers/media/test-drivers/vidtv) vidtv_mux_pid_ctx_init = Add allocation failure error check and ensure PID context is not used when NULL (defensive programming) - Configuration
In vidtv_mux_push_si(), add defensive NULL checks in the paths that call vidtv_mux_get_pid_ctx() (especially for PMT section PIDs) so the function does not dereference a near-NULL pointer returned from vidtv_mux_create_pid_ctx_once()/vidtv_mux_get_pid_ctx().
Linux kernel (drivers/media/test-drivers/vidtv) vidtv_mux_push_si = Add defensive NULL checks for vidtv_mux_get_pid_ctx() results before dereferencing - Compensating control
Until the kernel fix is deployed, mitigate potential crashes by isolating or disabling the affected vidtv media test-driver functionality (drivers/media/test-drivers/vidtv) if it is not required in your environment.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53382?
The severity of CVE-2026-53382 is medium with a CVSS score of 5.5.
How do I fix CVE-2026-53382?
To fix CVE-2026-53382, update the Linux kernel to a version that includes the patch addressing the NULL pointer dereference.
What systems are affected by CVE-2026-53382?
CVE-2026-53382 affects systems running vulnerable versions of the Linux kernel with the vidtv media driver.
What kind of vulnerability is CVE-2026-53382?
CVE-2026-53382 is classified as a Null Pointer Dereference vulnerability.
What type of issue does CVE-2026-53382 cause?
CVE-2026-53382 can lead to a general protection fault in the system when the affected function is executed.