CVE-2026-31583

media: em28xx: fix use-after-free in em28xx_v4l2_open()

State: Published
Severity: Not scored
Published: Apr 24, 2026
Updated: Oct 15, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: em28xx: fix use-after-free in em28xx_v4l2_open()

em28xx_v4l2_open() reads dev->v4l2 without holding dev->lock, creating a race with em28xx_v4l2_init()'s error path and em28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct and set dev->v4l2 to NULL under dev->lock.

This race leads to two issues: - use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler, since the video_device is embedded in the freed em28xx_v4l2 struct. - NULL pointer dereference in em28xx_resolution_set() when accessing v4l2->norm, since dev->v4l2 has been set to NULL.

Fix this by moving the mutex_lock() before the dev->v4l2 read and adding a NULL check for dev->v4l2 under the lock.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8139a4d583abad45eb987b5a99b3281b6d435b7e to before 3c0283a59e36e3707c4a81f4952e362d31f876b8Affected 8139a4d583abad45eb987b5a99b3281b6d435b7e to before 2cbf81f76842e46bdf25823c70e1db4044a65678Affected 8139a4d583abad45eb987b5a99b3281b6d435b7e to before 38a327221f7f765e7d853b7bafe47e342441ec85Affected 8139a4d583abad45eb987b5a99b3281b6d435b7e to before b5d141ea15f173f15b9f0a72965902f3428c0d92Affected 8139a4d583abad45eb987b5a99b3281b6d435b7e to before 5fb2940327722b4684d2f964b54c1c90aa277324Affected 8139a4d583abad45eb987b5a99b3281b6d435b7e to before 871b8ea8ef39a6c253594649f4339378fad3d0ddAffected 8139a4d583abad45eb987b5a99b3281b6d435b7e to before 6b9e66437cc6123ddedac141e1b8b6fcf57d2972Affected 8139a4d583abad45eb987b5a99b3281b6d435b7e to before dd2b888e08d3b3d6aacd65d76cd44fac11da750fAffected 8139a4d583abad45eb987b5a99b3281b6d435b7e to before a66485a934c7187ae8e36517d40615fa2e961cffAffected
LinuxLinux	3.16Affected before 3.16Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.Not affected 7.0.1 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

8139a4d583abad45eb987b5a99b3281b6d435b7e to before 3c0283a59e36e3707c4a81f4952e362d31f876b8Affected
8139a4d583abad45eb987b5a99b3281b6d435b7e to before 2cbf81f76842e46bdf25823c70e1db4044a65678Affected
8139a4d583abad45eb987b5a99b3281b6d435b7e to before 38a327221f7f765e7d853b7bafe47e342441ec85Affected
8139a4d583abad45eb987b5a99b3281b6d435b7e to before b5d141ea15f173f15b9f0a72965902f3428c0d92Affected
8139a4d583abad45eb987b5a99b3281b6d435b7e to before 5fb2940327722b4684d2f964b54c1c90aa277324Affected
8139a4d583abad45eb987b5a99b3281b6d435b7e to before 871b8ea8ef39a6c253594649f4339378fad3d0ddAffected
8139a4d583abad45eb987b5a99b3281b6d435b7e to before 6b9e66437cc6123ddedac141e1b8b6fcf57d2972Affected
8139a4d583abad45eb987b5a99b3281b6d435b7e to before dd2b888e08d3b3d6aacd65d76cd44fac11da750fAffected
8139a4d583abad45eb987b5a99b3281b6d435b7e to before a66485a934c7187ae8e36517d40615fa2e961cffAffected

LinuxLinux

3.16Affected
before 3.16Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0.1 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.