CVE-2026-43058 Overview
CVE-2026-43058 affects the Linux kernel's vidtv (Virtual Digital TV) driver in the media subsystem. The functions vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() accept their argument structs by value rather than by reference. This pass-by-value pattern triggers MemorySanitizer (MSAN) uninit-value warnings because stack copies of the structs include uninitialized padding along with their MSAN shadow and origin metadata.
The issue falls under uninitialized memory use [CWE-908]. While only vidtv_ts_null_write_into() had triggered an MSAN report at the time of disclosure, both functions shared the same defect. Maintainers resolved the issue by passing both structs by const pointer.
Critical Impact
The flaw is a low-risk correctness defect in a virtual TV test driver. It produces MSAN warnings without a known path to privilege escalation or remote exploitation.
Affected Products
- Linux kernel media subsystem (drivers/media/test-drivers/vidtv/)
- Multiple stable kernel branches receiving backports (commits 1b2820c8, 57b01d94, 5f8e73bd, 6d75a9ec, be57e52e, e3957eb2)
- Systems with the vidtv virtual DVB driver loaded
Discovery Timeline
- 2026-05-02 - CVE-2026-43058 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43058
Vulnerability Analysis
The vidtv driver simulates a digital TV tuner for testing the Linux DVB stack. Two helper functions, vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into(), generate MPEG-TS NULL packets and Program Clock Reference packets respectively. Both functions originally received their parameter structures by value.
When the compiler generates a stack copy of a struct, any padding bytes and uninitialized fields propagate into the callee's frame. MemorySanitizer instruments these copies and tracks shadow and origin metadata, producing uninit-value reports when the copied bytes are later read or written into a buffer. The warning indicates the stack copy itself, not the eventual packet payload, contains undefined bytes.
The defect is a code-quality and memory-hygiene issue rather than a directly exploitable vulnerability. It does, however, demonstrate the class of bug [CWE-908] where uninitialized memory can be observed beyond its intended scope.
Root Cause
The root cause is the C calling convention used in the original implementation. Passing a struct by value forces the compiler to copy every byte, including padding inserted for alignment. The vidtv functions never modified the inputs, so the copy served no purpose. MSAN flagged the propagation of poisoned shadow bytes through the copy.
Attack Vector
No practical attack vector has been published. The vidtv driver is a test module typically not loaded on production systems. An attacker would need local access and the ability to load or interact with the virtual DVB device to influence the affected code paths. The EPSS score of 0.024% reflects negligible exploitation likelihood.
Technical details are available in the upstream patches, including Kernel Commit 1b2820c8 and Kernel Commit e3957eb2.
Detection Methods for CVE-2026-43058
Indicators of Compromise
- No malicious indicators are associated with this defect because no exploit has been demonstrated.
- MSAN reports referencing vidtv_ts_null_write_into or vidtv_ts_pcr_write_into in kernel test logs indicate the unpatched condition.
Detection Strategies
- Inventory running kernels and compare against the fixed commits listed in the upstream stable tree.
- Check whether the vidtv module is loaded with lsmod | grep vidtv on Linux hosts.
- Review kernel build configurations for CONFIG_DVB_VIDTV=y or =m and confirm the module is excluded from production images.
Monitoring Recommendations
- Track kernel version drift across the Linux fleet using a centralized telemetry pipeline.
- Subscribe to the linux-media and stable kernel mailing lists for follow-on fixes in the vidtv driver.
- Use Linux endpoint telemetry to flag unexpected loading of test-only modules such as vidtv, vivid, or vimc.
How to Mitigate CVE-2026-43058
Immediate Actions Required
- Apply the latest stable kernel update from your distribution that includes the referenced fix commits.
- Confirm the vidtv module is not loaded on production hosts and blacklist it where it is not needed.
- Validate that build pipelines compiling custom kernels pull the patched stable branch tags.
Patch Information
Upstream maintainers fixed the issue by changing both functions to accept their argument structs by const pointer, eliminating the stack copy and the associated MSAN shadow propagation. The const qualifier enforces that the callees do not modify the structs. The fix is distributed across six stable backport commits: Kernel Commit 1b2820c8, Kernel Commit 57b01d94, Kernel Commit 5f8e73bd, Kernel Commit 6d75a9ec, Kernel Commit be57e52e, and Kernel Commit e3957eb2.
Workarounds
- Unload the vidtv module with modprobe -r vidtv if it is loaded but not required.
- Add blacklist vidtv to /etc/modprobe.d/ to prevent autoload.
- Build production kernels without CONFIG_DVB_VIDTV to remove the affected code entirely.
# Configuration example
echo 'blacklist vidtv' | sudo tee /etc/modprobe.d/blacklist-vidtv.conf
sudo modprobe -r vidtv 2>/dev/null || true
lsmod | grep -E '^vidtv' && echo 'vidtv still loaded' || echo 'vidtv not loaded'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
