Medium 5.5Published Apr 24, 2026

CVE-2026-31599media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

Updated under an hour ago (Oct 26, 2026, 5:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections syzbot reported a general protection fault in vidtv_psi_desc_assign [1]. vidtv_psi_pmt_stream_init() can return NULL on memory allocation failure, but vidtv_channel_pmt_match_sections() does not check for this. When tail is NULL, the subsequent call to vidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL pointer offset, causing a general protection fault. Add a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean up the already-allocated stream chain and return. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629 Call Trace: <TASK> vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline] vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479 vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline] vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 54e18a23e62e81b8335cec3e8e9c5cb33fd88665; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 5c986b77200b5ea754ba6636deacc7e0942fec9b; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 93d9e747a9e8a5ca9e3c5e37dcff76b40399139f; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before b7efb4c94797c504a1c678edb48c2aa311d3309f; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before e589de36da106ef739ba98f66f5a5c2023370706; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 2dff11fb5098ae453651f8f77e94ad499c078022; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before b832cfd516b8504e95884622cee60bf9a39b7945; from f90cf6079bf67988f8b1ad1ade70fc89d0080905 before 07c1e474cf9acf777f09d14a8f8dfcef5b84e46f; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.10 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1	NVD

References

References

https://git.kernel.org/stable/c/54e18a23e62e81b8335cec3e8e9c5cb33fd88665
https://git.kernel.org/stable/c/5c986b77200b5ea754ba6636deacc7e0942fec9b
https://git.kernel.org/stable/c/93d9e747a9e8a5ca9e3c5e37dcff76b40399139f
https://git.kernel.org/stable/c/b7efb4c94797c504a1c678edb48c2aa311d3309f	patch
https://git.kernel.org/stable/c/e589de36da106ef739ba98f66f5a5c2023370706	patch
https://git.kernel.org/stable/c/2dff11fb5098ae453651f8f77e94ad499c078022	patch
https://git.kernel.org/stable/c/b832cfd516b8504e95884622cee60bf9a39b7945	patch
https://git.kernel.org/stable/c/07c1e474cf9acf777f09d14a8f8dfcef5b84e46f	patch
https://git.kernel.org/stable/c/f8e1fc918a9fe67103bcda01d20d745f264d00a7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.