SB20260425129 - Improper control of a resource through its lifetime in Linux kernel test-drivers vidtv driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31585)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in vidtv_start_feed() when handling a start_streaming failure. A local user can trigger a start_streaming failure to cause a denial of service.

The issue can corrupt the nfeeds counter and may leave partially allocated mux and channel resources uncleared when the stop path returns early.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/25f19e476ab15defe698504212899fdb9f7cd61b
• https://git.kernel.org/stable/c/4bf95f797edd63c93330eafb6d6e670982344b9b
• https://git.kernel.org/stable/c/83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd
• https://git.kernel.org/stable/c/98c22210aeadce67d9d20059f0dbbd01ba7fdbba