CVE-2026-31573

media: verisilicon: Fix kernel panic due to __initconst misuse

State
Published
Severity
Not scored
Published
Apr 24, 2026
Updated
Oct 30, 2026
Reserved
Mar 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

media: verisilicon: Fix kernel panic due to __initconst misuse

Fix a kernel panic when probing the driver as a module:

Unable to handle kernel paging request at virtual address ffffd9c18eb05000 of_find_matching_node_and_match+0x5c/0x1a0 hantro_probe+0x2f4/0x7d0 [hantro_vpu]

The imx8mq_vpu_shared_resources array is referenced by variant structures through their shared_devices field. When built as a module, __initconst causes this data to be freed after module init, but it's later accessed during probe, causing a page fault.

The imx8mq_vpu_shared_resources is referenced from non-init code, so keeping __initconst or __initconst_or_module here is wrong.

Drop the __initconst annotation and let it live in the normal .rodata section.

A bug of __initconst called from regular non-init probe code leading to bugs during probe deferrals or during unbind-bind cycles.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 42a9fbccb33a38c5a9e0a84680939da8eae4f60e to before 53b88097bb0e0b895a691ae7da4a54b567c0d375Affected
  • f2efc1e8ab65bdb9b892af132887323e4df92f02 to before 5d177ff5eb235de9cc0b8e877466f5a3af6f573eAffected
  • 5133ef7c893c2c3aee7dd12503dc480de9dbfbb5 to before 07861e84b766c6db8014bc34138f3be4a62aad2aAffected
  • 286d629d10640bc22f3bf46aa4f356eb7975e862 to before 1e7e9119cf9b0d8585b27653b1a6dc31397c252eAffected
  • e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765 to before e8d97c270cb46a2a88739019d0f8547adc7d97daAffected
  • f988fbf0536b42f6a05ccc1ac709d60236ec1aa6Affected
  • 6.6.160 to before 6.7Affected
LinuxLinux
  • 6.19.6 to before 6.19.11Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.