---
id: CVE-2026-31583
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: em28xx: fix use-after-free in em28xx_v4l2_open()

  em28xx_v4l2_open() reads dev->v4l2 without holding dev->lock,
  creating a race with em28xx_v4l2_init()'s error p…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: em28xx: fix use-after-free in em28xx_v4l2_open()

  em28xx_v4l2_open() reads dev->v4l2 without holding dev->lock,
  creating a race with em28xx_v4l2_init()'s error p…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 6.6.136
  - 'linux_kernel >= 6.12, < 6.12.83'
  - 'linux_kernel >= 6.13, < 6.18.24'
  - 'linux_kernel >= 6.19, < 6.19.14'
  - 'linux_kernel >= 7.0, < 7.0.1'
patched:
  - linux_kernel 7.0.1
published: '2026-04-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:19:11.890'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31583'
references:
  - url: 'https://git.kernel.org/stable/c/2cbf81f76842e46bdf25823c70e1db4044a65678'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/38a327221f7f765e7d853b7bafe47e342441ec85'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3c0283a59e36e3707c4a81f4952e362d31f876b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5fb2940327722b4684d2f964b54c1c90aa277324'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6b9e66437cc6123ddedac141e1b8b6fcf57d2972'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/871b8ea8ef39a6c253594649f4339378fad3d0dd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a66485a934c7187ae8e36517d40615fa2e961cff'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b5d141ea15f173f15b9f0a72965902f3428c0d92'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dd2b888e08d3b3d6aacd65d76cd44fac11da750f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00174
epssPercentile: 0.06409
ingestedAt: '2026-10-15T03:30:12.858Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: em28xx: fix use-after-free in em28xx_v4l2_open()

em28xx_v4l2_open() reads dev->v4l2 without holding dev->lock,
creating a race with em28xx_v4l2_init()'s error path and
em28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct
and set dev->v4l2 to NULL under dev->lock.

This race leads to two issues:
 - use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler,
   since the video_device is embedded in the freed em28xx_v4l2 struct.
 - NULL pointer dereference in em28xx_resolution_set() when accessing
   v4l2->norm, since dev->v4l2 has been set to NULL.

Fix this by moving the mutex_lock() before the dev->v4l2 read and
adding a NULL check for dev->v4l2 under the lock.

## Affected

- `linux_kernel < 6.6.136`
- `linux_kernel >= 6.12, < 6.12.83`
- `linux_kernel >= 6.13, < 6.18.24`
- `linux_kernel >= 6.19, < 6.19.14`
- `linux_kernel >= 7.0, < 7.0.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.1`