CVE-2026-31473: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports. We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_ioctl_reinit() so REINIT is in the same exclusion domain. This keeps request cleanup and queue cancellation from running in parallel for request-capable devices.

Affected products

• Linux Linux Kernel: from 4.20.1, before 5.10.253 (fixed in 5.10.253); from 5.11, before 5.15.203 (fixed in 5.15.203); from 5.16, before 6.1.168 (fixed in 6.1.168); from 6.2, before 6.6.131 (fixed in 6.6.131); from 6.7, before 6.12.80 (fixed in 6.12.80); from 6.13, before 6.18.21 (fixed in 6.18.21); …

Published 2026-04-22. Last modified 2026-06-17.