CVE-2026-31573

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31573", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.119Z", "datePublished": "2026-04-24T14:35:51.421Z", "dateUpdated": "2026-10-30T12:24:23.572Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:23.572Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: Fix kernel panic due to __initconst misuse\n\nFix a kernel panic when probing the driver as a module:\n\n Unable to handle kernel paging request at virtual address\n ffffd9c18eb05000\n of_find_matching_node_and_match+0x5c/0x1a0\n hantro_probe+0x2f4/0x7d0 [hantro_vpu]\n\nThe imx8mq_vpu_shared_resources array is referenced by variant\nstructures through their shared_devices field. When built as a\nmodule, __initconst causes this data to be freed after module\ninit, but it's later accessed during probe, causing a page fault.\n\nThe imx8mq_vpu_shared_resources is referenced from non-init code,\nso keeping __initconst or __initconst_or_module here is wrong.\n\nDrop the __initconst annotation and let it live in the normal .rodata\nsection.\n\nA bug of __initconst called from regular non-init probe code\nleading to bugs during probe deferrals or during unbind-bind cycles."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"], "versions": [{"version": "42a9fbccb33a38c5a9e0a84680939da8eae4f60e", "lessThan": "53b88097bb0e0b895a691ae7da4a54b567c0d375", "status": "affected", "versionType": "git"}, {"version": "f2efc1e8ab65bdb9b892af132887323e4df92f02", "lessThan": "5d177ff5eb235de9cc0b8e877466f5a3af6f573e", "status": "affected", "versionType": "git"}, {"version": "5133ef7c893c2c3aee7dd12503dc480de9dbfbb5", "lessThan": "07861e84b766c6db8014bc34138f3be4a62aad2a", "status": "affected", "versionType": "git"}, {"version": "286d629d10640bc22f3bf46aa4f356eb7975e862", "lessThan": "1e7e9119cf9b0d8585b27653b1a6dc31397c252e", "status": "affected", "versionType": "git"}, {"version": "e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765", "lessThan": "e8d97c270cb46a2a88739019d0f8547adc7d97da", "status": "affected", "versionType": "git"}, {"version": "f988fbf0536b42f6a05ccc1ac709d60236ec1aa6", "status": "affected", "versionType": "git"}, {"version": "6.6.160", "lessThan": "6.7", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"], "versions": [{"version": "6.19.6", "lessThan": "6.19.11", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.6", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.160"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/53b88097bb0e0b895a691ae7da4a54b567c0d375"}, {"url": "https://git.kernel.org/stable/c/5d177ff5eb235de9cc0b8e877466f5a3af6f573e"}, {"url": "https://git.kernel.org/stable/c/07861e84b766c6db8014bc34138f3be4a62aad2a"}, {"url": "https://git.kernel.org/stable/c/1e7e9119cf9b0d8585b27653b1a6dc31397c252e"}, {"url": "https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}], "title": "media: verisilicon: Fix kernel panic due to __initconst misuse", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "53b88097bb0e0b895a691ae7da4a54b567c0d375", "status": "affected", "version": "42a9fbccb33a38c5a9e0a84680939da8eae4f60e", "versionType": "git"}, {"lessThan": "5d177ff5eb235de9cc0b8e877466f5a3af6f573e", "status": "affected", "version": "f2efc1e8ab65bdb9b892af132887323e4df92f02", "versionType": "git"}, {"lessThan": "07861e84b766c6db8014bc34138f3be4a62aad2a", "status": "affected", "version": "5133ef7c893c2c3aee7dd12503dc480de9dbfbb5", "versionType": "git"}, {"lessThan": "1e7e9119cf9b0d8585b27653b1a6dc31397c252e", "status": "affected", "version": "286d629d10640bc22f3bf46aa4f356eb7975e862", "versionType": "git"}, {"lessThan": "e8d97c270cb46a2a88739019d0f8547adc7d97da", "status": "affected", "version": "e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765", "versionType": "git"}, {"status": "affected", "version": "f988fbf0536b42f6a05ccc1ac709d60236ec1aa6", "versionType": "git"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.160", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.19.11", "status": "affected", "version": "6.19.6", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BFE33C3-C605-4CC2-9F15-3494BA78E2C9", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: Fix kernel panic due to __initconst misuse\n\nFix a kernel panic when probing the driver as a module:\n\n Unable to handle kernel paging request at virtual address\n ffffd9c18eb05000\n of_find_matching_node_and_match+0x5c/0x1a0\n hantro_probe+0x2f4/0x7d0 [hantro_vpu]\n\nThe imx8mq_vpu_shared_resources array is referenced by variant\nstructures through their shared_devices field. When built as a\nmodule, __initconst causes this data to be freed after module\ninit, but it's later accessed during probe, causing a page fault.\n\nThe imx8mq_vpu_shared_resources is referenced from non-init code,\nso keeping __initconst or __initconst_or_module here is wrong.\n\nDrop the __initconst annotation and let it live in the normal .rodata\nsection.\n\nA bug of __initconst called from regular non-init probe code\nleading to bugs during probe deferrals or during unbind-bind cycles."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: verisilicon: Corrige un p\u00e1nico del kernel debido al uso indebido de __initconst\n\nCorrige un p\u00e1nico del kernel al sondear el controlador como un m\u00f3dulo:\n\n No se puede manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual\n ffffd9c18eb05000\n of_find_matching_node_and_match+0x5c/0x1a0\n hantro_probe+0x2f4/0x7d0 [hantro_vpu]\n\nEl array imx8mq_vpu_shared_resources es referenciado por estructuras variantes a trav\u00e9s de su campo shared_devices. Cuando se construye como un m\u00f3dulo, __initconst hace que estos datos sean liberados despu\u00e9s de la inicializaci\u00f3n del m\u00f3dulo, pero se accede a ellos m\u00e1s tarde durante el sondeo, causando un fallo de p\u00e1gina.\n\nEl imx8mq_vpu_shared_resources es referenciado desde c\u00f3digo no de inicializaci\u00f3n, por lo que mantener __initconst o __initconst_or_module aqu\u00ed es incorrecto.\n\nElimina la anotaci\u00f3n __initconst y deja que resida en la secci\u00f3n normal .rodata.\n\nUn error de __initconst llamado desde c\u00f3digo de sondeo regular no de inicializaci\u00f3n que lleva a errores durante aplazamientos de sondeo o durante ciclos de desvinculaci\u00f3n-vinculaci\u00f3n."}], "id": "CVE-2026-31573", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:31.857", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07861e84b766c6db8014bc34138f3be4a62aad2a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1e7e9119cf9b0d8585b27653b1a6dc31397c252e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/53b88097bb0e0b895a691ae7da4a54b567c0d375"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d177ff5eb235de9cc0b8e877466f5a3af6f573e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: media: verisilicon: Fix kernel panic due to __initconst misuse", "id": "2461493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461493"}, "csaw": false, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's verisilicon hantro_vpu media driver. When the driver is built as a module, a misuse of the __initconst annotation causes data to be prematurely freed. This freed memory is later accessed during driver probing or unbind-bind cycles, leading to a kernel panic and a Denial of Service (DoS) condition. A local attacker could potentially trigger this flaw by loading and unloading the affected module."], "name": "CVE-2026-31573", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31573\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31573\nhttps://lore.kernel.org/linux-cve-announce/2026042403-CVE-2026-31573-4d0a@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[286d629d10640bc22f3bf46aa4f356eb7975e862,1e7e9119cf9b0d8585b27653b1a6dc31397c252e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765,e8d97c270cb46a2a88739019d0f8547adc7d97da)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.6,6.19.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T14:09:11.156512+00:00", "value": {"mitigation_remediation": ["Apply the latest kernel release that removes the __initconst annotation from the Verisilicon media driver.", "If a kernel update cannot be performed immediately, disable or uninstall the hantro_vpu module to prevent accidental loading.", "Audit other kernel modules for misuse of __initconst or similar initialization attributes to avoid repeat issues."], "summary": {"action": "Patch", "impact": "Kernel Panic (Denial of Service)"}, "threat_synthesis": {"affected_systems": "Affected only the Linux kernel media subsystem for Verisilicon devices. No specific kernel version range is listed, but any configuration that loads the hantro_vpu module remains vulnerable until the upstream fix is applied.", "description_and_impact": "The vulnerability arises from improper use of the __initconst attribute in the Verisilicon media driver within the Linux kernel, leading to a kernel paging request error when the driver is probed as a module. This causes a kernel panic, effectively crashing the system and denying service. The flaw is an example of CWE\u2011825, improper handling of data with incorrect lifetime annotations.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not in the CISA KEV list. Attack feasibility requires the ability to load or reload the affected module, which typically requires administrative privileges or a local physical user with the ability to insert kernel modules. In such environments, an attacker could crash the system by triggering the probe sequence."}}}}, "created": "2026-04-27T19:00:15.749864+00:00", "updated": "2026-04-28T14:15:34.914809+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}