{"cve":"CVE-2026-31583","nvd":{"published":"2026-04-24T15:16:33.017","modified":"2026-10-15T02:19:11.890","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: em28xx: fix use-after-free in em28xx_v4l2_open()\n\nem28xx_v4l2_open() reads dev->v4l2 without holding dev->lock,\ncreating a race with em28xx_v4l2_init()'s error path and\nem28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct\nand set dev->v4l2 to NULL under dev->lock.\n\nThis race leads to two issues:\n - use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler,\n   since the video_device is embedded in the freed em28xx_v4l2 struct.\n - NULL pointer dereference in em28xx_resolution_set() when accessing\n   v4l2->norm, since dev->v4l2 has been set to NULL.\n\nFix this by moving the mutex_lock() before the dev->v4l2 read and\nadding a NULL check for dev->v4l2 under the lock.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/2cbf81f76842e46bdf25823c70e1db4044a65678","https://git.kernel.org/stable/c/38a327221f7f765e7d853b7bafe47e342441ec85","https://git.kernel.org/stable/c/3c0283a59e36e3707c4a81f4952e362d31f876b8","https://git.kernel.org/stable/c/5fb2940327722b4684d2f964b54c1c90aa277324","https://git.kernel.org/stable/c/6b9e66437cc6123ddedac141e1b8b6fcf57d2972"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:33:09.003606135+00:00"},"epss":{"cve":"CVE-2026-31583","score":0.00131,"percentile":0.02694,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}