{"id":"CVE-2026-31473","state":"PUBLISHED","title":"media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex\n\nMEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)\nqueue teardown paths. This can race request object cleanup against vb2\nqueue cancellation and lead to use-after-free reports.\n\nWe already serialize request queueing against STREAMON/OFF with\nreq_queue_mutex. Extend that serialization to REQBUFS, and also take\nthe same mutex in media_request_ioctl_reinit() so REINIT is in the\nsame exclusion domain.\n\nThis keeps request cleanup and queue cancellation from running in\nparallel for request-capable devices.","publishedAt":"2026-04-22T13:54:00.970Z","updatedAt":"2026-10-19T18:35:50.197Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"331242998a7ade5c2f65e14988901614629f3db5","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"2c685e99efb3b3bd2b78699fba6b1cf321975db0","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"585fd9a2063dacce8b2820f675ef23d5d17434c5","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"1a0d9083c24fbd5d22f7100f09d11e4d696a5f01","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"d8549a453d5bdc0a71de66ad47a1106703406a56","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"72b9e81e0203f03c40f3adb457f55bd4c8eb112d","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"cf2023e84f0888f96f4b65dc0804e7f3651969c1","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"bef4f4a88b73e4cc550d25f665b8a9952af22773","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.20","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.20","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"]}],"references":["https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5","https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0","https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5","https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01","https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56","https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d","https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1","https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31473.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31473","state":"PUBLISHED","datePublished":"2026-04-22T13:54:00.970Z","dateUpdated":"2026-10-19T18:35:50.197Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.098Z"},"containers":{"cna":{"title":"media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex\n\nMEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)\nqueue teardown paths. This can race request object cleanup against vb2\nqueue cancellation and lead to use-after-free reports.\n\nWe already serialize request queueing against STREAMON/OFF with\nreq_queue_mutex. Extend that serialization to REQBUFS, and also take\nthe same mutex in media_request_ioctl_reinit() so REINIT is in the\nsame exclusion domain.\n\nThis keeps request cleanup and queue cancellation from running in\nparallel for request-capable devices."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"331242998a7ade5c2f65e14988901614629f3db5","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"2c685e99efb3b3bd2b78699fba6b1cf321975db0","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"585fd9a2063dacce8b2820f675ef23d5d17434c5","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"1a0d9083c24fbd5d22f7100f09d11e4d696a5f01","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"d8549a453d5bdc0a71de66ad47a1106703406a56","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"72b9e81e0203f03c40f3adb457f55bd4c8eb112d","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"cf2023e84f0888f96f4b65dc0804e7f3651969c1","versionType":"git"},{"version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","status":"affected","lessThan":"bef4f4a88b73e4cc550d25f665b8a9952af22773","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.20","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.20","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5"},{"url":"https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0"},{"url":"https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5"},{"url":"https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01"},{"url":"https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56"},{"url":"https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d"},{"url":"https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1"},{"url":"https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable paths are reached through local `ioctl()` calls on media/video device file descriptors: `MEDIA_REQUEST_IOC_REINIT` on a request fd and `VIDIOC_REQBUFS(0)` on a V4L2 video fd. The affected code is not reachable directly from network packets or adjacent/physical protocol input.\nAC:L - This is a race, but an attacker controls both racing operations by issuing concurrent ioctls from local threads or processes. No condition beyond access to a request-capable media device is required.\nPR:L - The kernel path has no capability or admin check; the attacker only needs ordinary local ability to open the relevant `/dev/media*` and `/dev/video*` nodes. This is basic local privilege rather than real root/admin privilege.\nUI:N - Once the attacker can run local code and open the device nodes, exploitation is driven entirely by attacker-issued ioctls. No separate victim action is required.\nS:U - The vulnerability corrupts kernel media/videobuf2 request state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is a use-after-free involving media request objects and vb2 buffer/request state during concurrent cleanup and queue teardown. Per kernel CVSS guidance, UAF memory corruption can be leveraged for kernel memory disclosure, so confidentiality impact is high.\nI:H - The race can corrupt freed kernel heap objects and request/buffer state, giving a plausible path to control-flow or arbitrary-write style exploitation. Per kernel CVSS guidance, use-after-free memory corruption warrants high integrity impact.\nA:H - The fix commit explicitly addresses use-after-free reports, and such kernel UAFs can reliably trigger KASAN reports, oopses, or panics. This is a high availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:22:51.779Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.1.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.6.131"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.12.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.18.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-31473","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:09:53.356132Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","lang":"en","type":"CWE","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:35:50.197Z"}}]}}}