Executive brief
A vulnerability in the Linux kernel's digital video test driver (vidtv) can cause system instability or memory leaks. When the driver fails to start a video stream, it incorrectly tracks the number of active feeds, leading to a corrupted internal state. This can prevent future streams from starting correctly and may eventually lead to a system crash or resource exhaustion.
Technical details
A state corruption vulnerability exists in the Linux kernel's vidtv bridge driver within the 'vidtv_start_feed' function. When 'vidtv_start_streaming' fails, the 'nfeeds' counter is incremented but not subsequently decremented, leading to an inconsistent driver state where the system believes feeds are active when they are not. This corruption causes subsequent 'start_feed' calls to skip necessary multiplexer initialization and 'stop_feed' calls to attempt stopping non-existent streams. Furthermore, because the stop path returns early when 'dvb->streaming' is false, partially allocated resources (mux and channel) are never freed, resulting in a memory leak (CWE-401). The issue was identified by syzbot and has been patched across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.10 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-03-01: other: Patch authored
- 2026-04-24: disclosed: CVE published
- 2026-04-28: other: NIST analysis completed
References
- https://git.kernel.org/stable/c/17cb7957c979529cc98ff57f7ac331532f1f7c83
- https://git.kernel.org/stable/c/25f19e476ab15defe698504212899fdb9f7cd61b
- https://git.kernel.org/stable/c/4bf95f797edd63c93330eafb6d6e670982344b9b
- https://git.kernel.org/stable/c/60f768d46df561e06d92ffcacc00909f37a0f23d
- https://git.kernel.org/stable/c/80900b5424f3454256153ce386388df43b324f63
- https://git.kernel.org/stable/c/83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd
- https://git.kernel.org/stable/c/98c22210aeadce67d9d20059f0dbbd01ba7fdbba