Medium 5.5Published Apr 24, 2026

CVE-2026-31585media: vidtv: fix nfeeds state corruption on start_streaming failure

Updated under an hour ago (Oct 27, 2026, 4:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix nfeeds state corruption on start_streaming failure syzbot reported a memory leak in vidtv_psi_service_desc_init [1]. When vidtv_start_streaming() fails inside vidtv_start_feed(), the nfeeds counter is left incremented even though no feed was actually started. This corrupts the driver state: subsequent start_feed calls see nfeeds > 1 and skip starting the mux, while stop_feed calls eventually try to stop a non-existent stream. This state corruption can also lead to memory leaks, since the mux and channel resources may be partially allocated during a failed start_streaming but never cleaned up, as the stop path finds dvb->streaming == false and returns early. Fix by decrementing nfeeds back when start_streaming fails, keeping the counter in sync with the actual number of active feeds. [1] BUG: memory leak unreferenced object 0xffff888145b50820 (size 32): comm "syz.0.17", pid 6068, jiffies 4294944486 backtrace (crc 90a0c7d4): vidtv_psi_service_desc_init+0x74/0x1b0 drivers/media/test-drivers/vidtv/vidtv_psi.c:288 vidtv_channel_s302m_init+0xb1/0x2a0 drivers/media/test-drivers/vidtv/vidtv_channel.c:83 vidtv_channels_init+0x1b/0x40 drivers/media/test-drivers/vidtv/vidtv_channel.c:524 vidtv_mux_init+0x516/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:518 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline] vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before f8cccb427e65d725fc0ba05e8900b4676eda268e; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 60f768d46df561e06d92ffcacc00909f37a0f23d; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 80900b5424f3454256153ce386388df43b324f63; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 17cb7957c979529cc98ff57f7ac331532f1f7c83; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 98c22210aeadce67d9d20059f0dbbd01ba7fdbba; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 25f19e476ab15defe698504212899fdb9f7cd61b; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 4bf95f797edd63c93330eafb6d6e670982344b9b; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.10 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1	NVD

References

References

https://git.kernel.org/stable/c/f8cccb427e65d725fc0ba05e8900b4676eda268e
https://git.kernel.org/stable/c/60f768d46df561e06d92ffcacc00909f37a0f23d
https://git.kernel.org/stable/c/80900b5424f3454256153ce386388df43b324f63
https://git.kernel.org/stable/c/17cb7957c979529cc98ff57f7ac331532f1f7c83	patch
https://git.kernel.org/stable/c/98c22210aeadce67d9d20059f0dbbd01ba7fdbba	patch
https://git.kernel.org/stable/c/25f19e476ab15defe698504212899fdb9f7cd61b	patch
https://git.kernel.org/stable/c/83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd	patch
https://git.kernel.org/stable/c/4bf95f797edd63c93330eafb6d6e670982344b9b	patch
https://git.kernel.org/stable/c/a0e5a598fe9a4612b852406b51153b881592aede	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.