High 7.8Published Apr 24, 2026

CVE-2026-31583media: em28xx: fix use-after-free in em28xx_v4l2_open()

Updated under an hour ago (Oct 27, 2026, 3:40 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: fix use-after-free in em28xx_v4l2_open() em28xx_v4l2_open() reads dev->v4l2 without holding dev->lock, creating a race with em28xx_v4l2_init()'s error path and em28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct and set dev->v4l2 to NULL under dev->lock. This race leads to two issues: - use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler, since the video_device is embedded in the freed em28xx_v4l2 struct. - NULL pointer dereference in em28xx_resolution_set() when accessing v4l2->norm, since dev->v4l2 has been set to NULL. Fix this by moving the mutex_lock() before the dev->v4l2 read and adding a NULL check for dev->v4l2 under the lock.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	8139a4d583abad45eb987b5a99b3281b6d435b7e builds before 3c0283a59e36e3707c4a81f4952e362d31f876b8; 8139a4d583abad45eb987b5a99b3281b6d435b7e builds before 2cbf81f76842e46bdf25823c70e1db4044a65678; 8139a4d583abad45eb987b5a99b3281b6d435b7e builds before 38a327221f7f765e7d853b7bafe47e342441ec85; from 8139a4d583abad45eb987b5a99b3281b6d435b7e before b5d141ea15f173f15b9f0a72965902f3428c0d92; 8139a4d583abad45eb987b5a99b3281b6d435b7e builds before 5fb2940327722b4684d2f964b54c1c90aa277324; 8139a4d583abad45eb987b5a99b3281b6d435b7e builds before 871b8ea8ef39a6c253594649f4339378fad3d0dd; 8139a4d583abad45eb987b5a99b3281b6d435b7e builds before 6b9e66437cc6123ddedac141e1b8b6fcf57d2972; from 8139a4d583abad45eb987b5a99b3281b6d435b7e before dd2b888e08d3b3d6aacd65d76cd44fac11da750f; and 1 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	before 6.6.136; from 6.12 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1	NVD

References

References

https://git.kernel.org/stable/c/3c0283a59e36e3707c4a81f4952e362d31f876b8
https://git.kernel.org/stable/c/2cbf81f76842e46bdf25823c70e1db4044a65678
https://git.kernel.org/stable/c/38a327221f7f765e7d853b7bafe47e342441ec85
https://git.kernel.org/stable/c/b5d141ea15f173f15b9f0a72965902f3428c0d92	patch
https://git.kernel.org/stable/c/5fb2940327722b4684d2f964b54c1c90aa277324	patch
https://git.kernel.org/stable/c/871b8ea8ef39a6c253594649f4339378fad3d0dd	patch
https://git.kernel.org/stable/c/6b9e66437cc6123ddedac141e1b8b6fcf57d2972	patch
https://git.kernel.org/stable/c/dd2b888e08d3b3d6aacd65d76cd44fac11da750f	patch
https://git.kernel.org/stable/c/a66485a934c7187ae8e36517d40615fa2e961cff	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.