Junglewise Threat Intelligence

CVE-2026-43058: Linux Kernel vidtv uninitialized memory access in vidtv_ts

CVE-2026-43058 · Severity: info · CVSS 5.5 · Published 2026-05-02

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's vidtv driver, which is used for digital television testing and simulation. The issue involves how the system handles internal data structures, which could lead to memory errors or system instability. While primarily affecting system reliability, it could potentially be used by a local user to cause a denial-of-service (system crash).

Technical details

The vulnerability exists in the vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() functions within the vidtv driver. These functions were designed to take argument structs by value, which causes the compiler to create stack copies that may include uninitialized padding or metadata, triggering MSAN uninit-value warnings. An attacker with local access could potentially exploit this behavior to cause a kernel panic or system crash. The fix involves changing the function signatures to accept const pointers instead of pass-by-value structs, preventing unnecessary stack copies and ensuring memory integrity. Patching is available across multiple stable kernel branches.

Affected products

  • Linux Linux kernel 5.10 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1

Timeline

  • 2026-05-02: advisory: Initial CVE publication
  • 2026-04-22: patched: Fix committed to stable kernel trees

References