CVE-2026-31599: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31599 Overview

A NULL pointer dereference vulnerability has been identified in the Linux kernel's vidtv (Virtual Digital TV) test driver, specifically within the vidtv_channel_pmt_match_sections() function. The vulnerability was discovered by syzbot through automated kernel fuzzing and results in a general protection fault when memory allocation fails during PMT (Program Map Table) stream initialization.

The flaw occurs because vidtv_psi_pmt_stream_init() can return NULL on memory allocation failure, but the calling function vidtv_channel_pmt_match_sections() does not properly check for this condition. When the tail pointer is NULL, a subsequent call to vidtv_psi_desc_assign(&tail->descriptor, desc) attempts to dereference a NULL pointer offset, triggering a kernel crash.

Critical Impact

Local attackers with access to the vidtv driver can trigger a denial of service condition through a NULL pointer dereference, causing system instability or crash.

Affected Products

• Linux Kernel (vidtv media test driver)

Discovery Timeline

• April 24, 2026 - CVE-2026-31599 published to NVD
• April 29, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31599

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference) and affects the virtual Digital TV test driver subsystem in the Linux kernel. The vidtv driver is used for testing DVB (Digital Video Broadcasting) applications without requiring actual DVB hardware.

The vulnerability resides in the PSI (Program Specific Information) handling code, specifically in how the driver manages PMT stream structures. When the kernel is under memory pressure or an attacker deliberately exhausts memory resources, the vidtv_psi_pmt_stream_init() function may fail to allocate memory and return NULL. The calling code in vidtv_channel_pmt_match_sections() proceeds without validating this return value, leading to a NULL pointer dereference when accessing the descriptor member of the NULL tail pointer.

The impact is primarily a denial of service condition. The vulnerability requires local access to trigger, limiting the attack surface to authenticated users or processes that can interact with the vidtv driver. While the media test drivers are typically not loaded on production systems, environments using these drivers for DVB testing or development are at risk.

Root Cause

The root cause is a missing NULL pointer check after calling vidtv_psi_pmt_stream_init(). The function allocates memory for PMT stream structures and can legitimately return NULL when memory allocation fails. The calling function vidtv_channel_pmt_match_sections() assumes successful allocation without validation.

The vulnerable code path follows this sequence:

1. vidtv_start_feed() initiates streaming operations
2. vidtv_mux_init() initializes the multiplexer
3. vidtv_channel_si_init() sets up Service Information
4. vidtv_channel_pmt_match_sections() creates PMT stream entries
5. vidtv_psi_pmt_stream_init() returns NULL on allocation failure
6. vidtv_psi_desc_assign() dereferences the NULL pointer

Attack Vector

The attack vector is local, requiring an attacker to have access to a system with the vidtv kernel module loaded. Exploitation involves:

1. Memory Pressure: The attacker creates memory pressure conditions to increase the likelihood of allocation failures
2. Driver Interaction: The attacker triggers the vulnerable code path by initiating streaming operations through the vidtv interface
3. Crash Trigger: When memory allocation fails during PMT stream initialization, the NULL pointer dereference causes a kernel panic or general protection fault

The kernel crash trace shows the fault occurring at vidtv_psi_desc_assign+0x24/0x90 in drivers/media/test-drivers/vidtv/vidtv_psi.c:629, with KASAN (Kernel Address Sanitizer) detecting a null-ptr-deref in the memory range 0x0000000000000000-0x0000000000000007.

Detection Methods for CVE-2026-31599

Indicators of Compromise

• Kernel panic messages referencing vidtv_psi_desc_assign or vidtv_channel_pmt_match_sections
• KASAN null-ptr-deref reports in kernel logs related to the vidtv driver
• General protection fault (GPF) errors with RIP pointing to vidtv driver code
• Unexpected system reboots on systems with the vidtv module loaded

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for oops or panic messages mentioning vidtv driver functions
• Enable KASAN in development/testing kernels to catch NULL pointer dereferences early
• Use kernel tracing (ftrace) to monitor calls to vidtv_psi_pmt_stream_init() and validate return values
• Implement system monitoring to detect unexpected kernel module crashes or system instability

Monitoring Recommendations

• Configure centralized logging to capture kernel panic events across fleet
• Set up alerts for GPF (general protection fault) events in kernel logs
• Monitor for unusual memory pressure conditions that could trigger allocation failures
• Track vidtv module loading events on production systems where it should not be present

How to Mitigate CVE-2026-31599

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the NULL check fix
• If kernel update is not immediately possible, unload the vidtv module using rmmod vidtv
• Blacklist the vidtv module on production systems where DVB testing is not required
• Restrict local access to minimize the attack surface for this local-only vulnerability

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds a NULL check after vidtv_psi_pmt_stream_init() and properly cleans up already-allocated stream chain resources on failure.

Patched versions are available through the following kernel git commits:

• Kernel Git Commit 07c1e47
• Kernel Git Commit 2dff11f
• Kernel Git Commit b7efb4c
• Kernel Git Commit b832cfd
• Kernel Git Commit e589de3
• Kernel Git Commit f8e1fc9

Workarounds

• Blacklist the vidtv module by adding blacklist vidtv to /etc/modprobe.d/blacklist.conf
• Remove the vidtv module from the running kernel: sudo rmmod vidtv
• Restrict access to DVB device files using appropriate file permissions
• Consider using kernel live patching solutions if immediate reboot is not feasible

# Blacklist vidtv module to prevent loading
echo "blacklist vidtv" | sudo tee /etc/modprobe.d/vidtv-blacklist.conf

# Unload the module if currently loaded
sudo rmmod vidtv 2>/dev/null || echo "Module not loaded"

# Verify module is not loaded
lsmod | grep vidtv