CVE-2026-31473

A flaw was found in the Linux kernel's media, mc, and v4l2 subsystems. A race condition can occur when MEDIA_REQUEST_IOC_REINIT runs concurrently with VIDIOC_REQBUFS(0) queue teardown paths, leading to a use-after-free vulnerability. This flaw could allow a local attacker to cause a system crash (denial of service) or potentially execute arbitrary code with elevated privileges.

Red Hat acknowledges this upstream media/V4L2 fix. The defect is a concurrency bug between MEDIA_REQUEST_IOC_REINIT and REQBUFS teardown that could corrupt request and vb2 queue lifetimes. Customers should consume corrected kernels through their product errata. Exploitation requires a local user able to exercise request-capable media nodes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.