Skip to main content

Linux Kernel EUVDEUVD-2026-25466

| CVE-2026-31573 MEDIUM
2026-04-24 Linux GHSA-2pqc-qvpf-mwm4
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H over NVD's AC:L because the panic requires both module-mode build and a secondary probe event, not guaranteed on every load.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:08 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:29 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25466
CVE Published
Apr 24, 2026 - 14:35 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: verisilicon: Fix kernel panic due to __initconst misuse

Fix a kernel panic when probing the driver as a module:

Unable to handle kernel paging request at virtual address ffffd9c18eb05000 of_find_matching_node_and_match+0x5c/0x1a0 hantro_probe+0x2f4/0x7d0 [hantro_vpu]

The imx8mq_vpu_shared_resources array is referenced by variant structures through their shared_devices field. When built as a module, __initconst causes this data to be freed after module init, but it's later accessed during probe, causing a page fault.

The imx8mq_vpu_shared_resources is referenced from non-init code, so keeping __initconst or __initconst_or_module here is wrong.

Drop the __initconst annotation and let it live in the normal .rodata section.

A bug of __initconst called from regular non-init probe code leading to bugs during probe deferrals or during unbind-bind cycles.

AnalysisAI

Kernel panic in the Linux hantro_vpu media driver (verisilicon subsystem) allows a local low-privileged user to crash the system by triggering a device probe deferral or unbind-bind cycle on affected NXP i.MX8MQ hardware. The root cause is an incorrect __initconst annotation on the imx8mq_vpu_shared_resources array, which causes the kernel to free that data after module initialization while variant structures retain a live pointer to it; subsequent probe calls dereference freed memory and fault. No public exploit or PoC exists and this CVE is not in CISA KEV; the EPSS score of 0.02% (5th percentile) confirms negligible real-world exploitation probability.

Technical ContextAI

The vulnerability resides in drivers/media/platform/verisilicon (hantro_vpu), a hardware video codec acceleration driver targeting VeriSilicon/Hantro VPU cores found on NXP i.MX8MQ SoCs. The imx8mq_vpu_shared_resources array is referenced from non-init probe code via variant structures' shared_devices field. Annotating it with __initconst places it in the .init.rodata ELF section, which the kernel frees after the init phase completes. When hantro_vpu is compiled as a loadable module (CONFIG_VIDEO_HANTRO=m), the freed pointer survives in the variant struct and is dereferenced via of_find_matching_node_and_match during subsequent probe invocations - such as deferred probes or driver rebind cycles - causing a paging fault and kernel panic. The fix is to remove the __initconst annotation so the array resides in the normal .rodata section. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covering kernel versions 6.19.6 through before 6.19.11. The CWE is not formally assigned, but the class is use-after-free of init-section memory due to incorrect linker section annotation.

RemediationAI

The upstream fix is delivered via two Linux stable commits: 1e7e9119cf9b0d8585b27653b1a6dc31397c252e (https://git.kernel.org/stable/c/1e7e9119cf9b0d8585b27653b1a6dc31397c252e) and e8d97c270cb46a2a88739019d0f8547adc7d97da (https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da). Upgrade to Linux kernel 6.19.11 or later, or apply these commits to the relevant stable branch. Distribution users on Red Hat or SUSE should consult vendor-specific advisories for backported packages. As an interim compensating control on systems not requiring hardware video acceleration, blacklisting the module via 'echo blacklist hantro_vpu >> /etc/modprobe.d/blacklist.conf' and rebooting will prevent the vulnerable code from loading; the trade-off is loss of hardware-accelerated video encode/decode on i.MX8MQ devices. Recompiling the driver as built-in (CONFIG_VIDEO_HANTRO=y) also avoids the defect since the init section is not freed, but requires a kernel rebuild.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25466 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy