CVE-2026-31473

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31473
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31473.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-31473
Downstream
Published
2026-04-22T13:54:00.970Z
Modified
2026-05-18T05:59:49.931412399Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
Details

In the Linux kernel, the following vulnerability has been resolved:

media: mc, v4l2: serialize REINIT and REQBUFS with reqqueuemutex

MEDIAREQUESTIOCREINIT can run concurrently with VIDIOCREQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports.

We already serialize request queueing against STREAMON/OFF with reqqueuemutex. Extend that serialization to REQBUFS, and also take the same mutex in mediarequestioctl_reinit() so REINIT is in the same exclusion domain.

This keeps request cleanup and queue cancellation from running in parallel for request-capable devices.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31473.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6093d3002eabd7c2913d97f1d1f4ce34b072acf9
Fixed
331242998a7ade5c2f65e14988901614629f3db5
Fixed
2c685e99efb3b3bd2b78699fba6b1cf321975db0
Fixed
585fd9a2063dacce8b2820f675ef23d5d17434c5
Fixed
1a0d9083c24fbd5d22f7100f09d11e4d696a5f01
Fixed
d8549a453d5bdc0a71de66ad47a1106703406a56
Fixed
72b9e81e0203f03c40f3adb457f55bd4c8eb112d
Fixed
cf2023e84f0888f96f4b65dc0804e7f3651969c1
Fixed
bef4f4a88b73e4cc550d25f665b8a9952af22773

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31473.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.10.253
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.203
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.168
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.131
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.80
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.21
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
6.19.11

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31473.json"