CVE-2026-53382: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53382 Overview

CVE-2026-53382 is a NULL pointer dereference vulnerability in the Linux kernel's Virtual Digital TV (vidtv) test driver. The flaw resides in the vidtv_mux_push_si function within drivers/media/test-drivers/vidtv/vidtv_mux.c. The syzbot fuzzer identified a general protection fault triggered when vidtv_mux_get_pid_ctx() returns NULL and the caller dereferences the pointer to access a continuity counter. The root cause is that vidtv_mux_pid_ctx_init() fails to check the return value of vidtv_mux_create_pid_ctx_once() for Program Map Table (PMT) section Packet Identifiers (PIDs). Kernel maintainers resolved the issue by adding the missing error check and defensive NULL checks throughout vidtv_mux_push_si.

Critical Impact
A local attacker triggering the vidtv driver code path can cause a kernel general protection fault, resulting in a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel versions containing the vidtv test driver in drivers/media/test-drivers/vidtv/
Distributions shipping the affected media: vidtv driver prior to the fix commits
Systems where the vidtv kernel module is loadable or built-in

Discovery Timeline

2026-07-19 - CVE-2026-53382 published to the National Vulnerability Database
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-53382

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the Linux kernel media test driver vidtv. When vidtv_mux_tick runs on the events workqueue, it calls vidtv_mux_push_si to emit Service Information (SI) packets. This function invokes vidtv_mux_get_pid_ctx() to retrieve the PID context needed for the transport stream continuity counter. If the corresponding PID context was never allocated, the lookup returns NULL, and the subsequent field access faults on a near-NULL address. The Kernel Address Sanitizer (KASAN) report classifies the fault as null-ptr-deref in range [0x0000000000000000-0x0000000000000007], confirming an offset dereference from a NULL base pointer.

Root Cause

The underlying defect lives in vidtv_mux_pid_ctx_init(). This initializer calls vidtv_mux_create_pid_ctx_once() to create PID contexts for PMT section PIDs but does not check whether the allocation succeeded. When memory allocation fails for a PMT PID, the context is silently skipped, yet vidtv_mux_pid_ctx_init() still returns success. Downstream code paths later assume the context exists and dereference the NULL pointer returned by vidtv_mux_get_pid_ctx().

Attack Vector

Exploitation requires local access to trigger the vidtv driver's mux tick workqueue under conditions that induce allocation failure for PMT PID contexts. The fault occurs in vidtv_psi_ts_psi_write_into+0x54a/0xbc0 at drivers/media/test-drivers/vidtv/vidtv_psi.c:197, called from vidtv_psi_pmt_write_into and ultimately from vidtv_mux_tick. The result is a kernel general protection fault that panics or destabilizes the running kernel. No remote attack vector is present because the vidtv driver is a local virtual DVB test device.

Refer to the upstream fix commits including Kernel Git Commit 232e4b3 and Kernel Git Commit f965cf for the precise source-level changes.

Detection Methods for CVE-2026-53382

Indicators of Compromise

Kernel oops messages referencing vidtv_psi_ts_psi_write_into or vidtv_mux_push_si in dmesg or /var/log/kern.log
KASAN reports containing null-ptr-deref in range [0x0000000000000000-0x0000000000000007] with the vidtv_mux_tick workqueue
Unexpected general protection faults tagged probably for non-canonical address 0xdffffc0000000000

Detection Strategies

Inventory hosts with the vidtv module loaded using lsmod | grep vidtv and correlate against kernel versions predating the fix
Monitor kernel crash telemetry for repeated faults originating in drivers/media/test-drivers/vidtv/
Audit systems for unauthorized loading of DVB test drivers on production hosts where they should not be present

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on general protection fault events tied to media drivers
Track kernel package versions across the fleet to identify unpatched hosts running affected kernels
Enable kdump or equivalent crash-dump collection to preserve stack traces for post-incident analysis

How to Mitigate CVE-2026-53382

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected systems
Unload the vidtv module on hosts that do not require virtual DVB functionality using modprobe -r vidtv
Restrict kernel module loading to root-only via kernel.modules_disabled=1 after boot on hardened systems

Patch Information

The fix is available in multiple stable Linux kernel branches through commits 232e4b3, 353d95, 455bc1, 6df7e1, 7d8bf3, b28b12, cd923d, f0f5a1, and f965cf. Consume updates via your distribution's kernel package channel.

Workarounds

Blacklist the vidtv module by adding blacklist vidtv to /etc/modprobe.d/blacklist-vidtv.conf on systems that do not need it
Prevent module autoloading using an install override that redirects to /bin/true
Limit access to accounts capable of loading kernel modules by removing CAP_SYS_MODULE from unprivileged users

bash

# Configuration example
echo "blacklist vidtv" | sudo tee /etc/modprobe.d/blacklist-vidtv.conf
echo "install vidtv /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-vidtv.conf
sudo modprobe -r vidtv 2>/dev/null || true
sudo update-initramfs -u