CVE-2026-31585: Linux Kernel Media Feed State Vulnerability

CVE-2026-31585 Overview

CVE-2026-31585 is a memory leak vulnerability [CWE-401] in the Linux kernel vidtv virtual digital TV test driver. The flaw resides in vidtv_start_feed() within drivers/media/test-drivers/vidtv/vidtv_bridge.c. When vidtv_start_streaming() fails, the nfeeds counter is left incremented while no feed was actually started. This state corruption desynchronizes the driver, causing subsequent start_feed calls to skip mux initialization and stop_feed calls to attempt stopping non-existent streams. Partially allocated mux and channel resources never get reclaimed because the stop path observes dvb->streaming == false and exits early. The issue was identified by syzbot fuzzing infrastructure.

Critical Impact
Local low-privileged users can trigger repeated memory leaks and driver state corruption in the vidtv media test driver, leading to kernel resource exhaustion and potential denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Systems with the vidtv virtual digital TV test driver enabled (CONFIG_DVB_VIDTV)
Distributions shipping the affected media test driver

Discovery Timeline

2026-04-24 - CVE-2026-31585 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31585

Vulnerability Analysis

The vulnerability is a memory leak rooted in incorrect error handling within the vidtv driver's feed lifecycle management. The vidtv_start_feed() function increments the nfeeds counter before invoking vidtv_start_streaming(). If vidtv_start_streaming() fails, the function returns an error but does not decrement nfeeds. The counter then misrepresents the number of active feeds.

This miscount has two downstream effects. First, later start_feed invocations observe nfeeds > 1 and skip the mux initialization branch, assuming streaming is already in progress. Second, stop_feed operations check dvb->streaming, which remains false from the original failure, and return early without freeing allocated mux and channel resources. syzbot's kmemleak detector flagged the leaked allocation originating from vidtv_psi_service_desc_init at drivers/media/test-drivers/vidtv/vidtv_psi.c:288.

Root Cause

The root cause is asymmetric reference counting in the failure path of vidtv_start_feed(). The counter increment is not reversed when the downstream vidtv_start_streaming() call fails. The fix decrements nfeeds on the failure branch so the counter remains synchronized with the actual number of active feeds.

Attack Vector

Exploitation requires local access and the ability to open the vidtv DVB device nodes. A local user with permissions to open /dev/dvb/adapterN/demuxN can repeatedly initiate feed start operations that fail at the streaming stage. Each failed attempt leaks kernel memory and further corrupts the driver state. Sustained abuse can exhaust kernel memory, resulting in availability impact on the host.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream commit messages referenced under vendor resources.

Detection Methods for CVE-2026-31585

Indicators of Compromise

Kernel log entries from kmemleak referencing vidtv_psi_service_desc_init, vidtv_channel_s302m_init, or vidtv_mux_init as backtrace origins.
Unexplained growth in kernel slab memory on systems where the vidtv module is loaded.
Repeated failures from vidtv_start_streaming visible in dmesg followed by continued open/close cycles on DVB device nodes.

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test systems and scan /sys/kernel/debug/kmemleak for allocations attributed to vidtv functions.
Monitor lsmod for the presence of vidtv on production hosts where the test driver should not be loaded.
Audit kernel version strings against the patched commit hashes 17cb7957, 25f19e47, 4bf95f79, 83110c2c, 98c22210, and a0e5a598.

Monitoring Recommendations

Track /proc/meminfo Slab and SUnreclaim values for sustained upward trends on affected hosts.
Alert on local processes opening DVB device nodes when no legitimate media workload exists.
Collect kernel logs centrally and create rules for repeated vidtv error returns.

How to Mitigate CVE-2026-31585

Immediate Actions Required

Update the Linux kernel to a stable release containing one of the fix commits listed in the vendor advisories.
Unload the vidtv module on systems where it is not required: modprobe -r vidtv.
Blacklist the vidtv module on production systems that do not use DVB test infrastructure.
Restrict access to /dev/dvb/* device nodes to trusted users via filesystem permissions.

Patch Information

The fix decrements nfeeds when vidtv_start_streaming() fails, keeping the counter synchronized with active feeds. Patches are available in the upstream stable tree under commits Kernel Git Commit 17cb7957, Kernel Git Commit 25f19e47, Kernel Git Commit 4bf95f79, Kernel Git Commit 83110c2c, Kernel Git Commit 98c22210, and Kernel Git Commit a0e5a598. Apply the distribution kernel update that incorporates these commits.

Workarounds

Disable the vidtv driver at build time by unsetting CONFIG_DVB_VIDTV and rebuilding the kernel.
Add blacklist vidtv to /etc/modprobe.d/blacklist-vidtv.conf to prevent autoloading.
Apply Linux capability restrictions to limit which users can interact with media subsystem device nodes.

bash

# Configuration example
# Prevent the vulnerable vidtv test driver from loading
echo 'blacklist vidtv' | sudo tee /etc/modprobe.d/blacklist-vidtv.conf
sudo modprobe -r vidtv 2>/dev/null

# Verify the module is not loaded
lsmod | grep vidtv

# Restrict DVB device node access to a trusted group
sudo chgrp video /dev/dvb/adapter*/demux* 2>/dev/null
sudo chmod 660 /dev/dvb/adapter*/demux* 2>/dev/null