CVE-2026-31473

media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex

State: Published
Severity: 7.8 High
Published: Apr 22, 2026
Updated: Oct 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex

MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports.

We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_ioctl_reinit() so REINIT is in the same exclusion domain.

This keeps request cleanup and queue cancellation from running in parallel for request-capable devices.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 331242998a7ade5c2f65e14988901614629f3db5Affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 2c685e99efb3b3bd2b78699fba6b1cf321975db0Affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 585fd9a2063dacce8b2820f675ef23d5d17434c5Affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 1a0d9083c24fbd5d22f7100f09d11e4d696a5f01Affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before d8549a453d5bdc0a71de66ad47a1106703406a56Affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 72b9e81e0203f03c40f3adb457f55bd4c8eb112dAffected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before cf2023e84f0888f96f4b65dc0804e7f3651969c1Affected 6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before bef4f4a88b73e4cc550d25f665b8a9952af22773Affected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.131 through 6.6.Not affected 6.12.80 through 6.12.Not affected 6.18.21 through 6.18.Not affected 6.19.11 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 331242998a7ade5c2f65e14988901614629f3db5Affected
6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 2c685e99efb3b3bd2b78699fba6b1cf321975db0Affected
6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 585fd9a2063dacce8b2820f675ef23d5d17434c5Affected
6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 1a0d9083c24fbd5d22f7100f09d11e4d696a5f01Affected
6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before d8549a453d5bdc0a71de66ad47a1106703406a56Affected
6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before 72b9e81e0203f03c40f3adb457f55bd4c8eb112dAffected
6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before cf2023e84f0888f96f4b65dc0804e7f3651969c1Affected
6093d3002eabd7c2913d97f1d1f4ce34b072acf9 to before bef4f4a88b73e4cc550d25f665b8a9952af22773Affected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.131 through 6.6.*Not affected
6.12.80 through 6.12.*Not affected
6.18.21 through 6.18.*Not affected
6.19.11 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.