Skip to main content

Linux Kernel EUVDEUVD-2026-25492

| CVE-2026-31599 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-04-24 Linux GHSA-x6jh-jrg5-6v49
Denial Of Service Linux Null Pointer Dereference Canonical
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local shell access
  2. Delivery
    Load or confirm vidtv test module present
  3. Exploit
    Open virtual DVB device
  4. Install
    Initiate PMT stream initialization
  5. C2
    Trigger memory allocation failure
  6. Execute
    NULL pointer dereference at vidtv_psi.c:629
  7. Impact
    Kernel panic / system crash

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) the vidtv kernel module must be compiled in (CONFIG_DVB_VIDTV=m or =y) and loaded - this is a non-default test driver absent from typical server and minimal kernels; (2) the attacker must have local shell access with sufficient privileges to open the vidtv DVB device node; (3) a memory allocation failure (OOM or memory pressure condition) must occur during vidtv_psi_pmt_stream_init() execution to produce the NULL return that triggers the dereference. Limiting factors: the driver is exclusively a test/development artifact not present in production kernels; it is not auto-loaded; triggering the OOM path may require specific system memory conditions rather than being reliably reproducible on demand. There is no remote attack vector - AV:L is confirmed by CVSS.
Impact

The CVSS 3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes this as a local, low-complexity denial-of-service requiring no elevated privileges. The impact is bounded to availability - no confidentiality or integrity compromise is possible. EPSS at 0.02% (5th percentile) corroborates that this is effectively unexploited in the wild. KEV status is absent, and no POC has been identified. The practical risk is further reduced by deployment scope: vidtv is a kernel test driver (CONFIG_DVB_VIDTV) that is not auto-loaded and is absent from most production or server kernel configurations; exploitation requires the module to be present and accessible. Ubuntu's USN-8488-1 advisory confirms the flaw reaches distribution kernels built with test drivers enabled. Overall, this is a low operational priority for production environments but warrants patching on development or general-purpose desktop kernels where the test driver may be compiled in.
Exploit ScenarioDerived

A local user with low-privilege shell access on a desktop Linux system running a distribution kernel with CONFIG_DVB_VIDTV compiled in (e.g., an unpatched Ubuntu release) accesses the vidtv virtual DVB device and initiates a streaming operation that triggers a memory allocation failure inside vidtv_psi_pmt_stream_init(). The NULL return is passed directly into vidtv_psi_desc_assign() without a NULL check, causing a kernel general protection fault at vidtv_psi.c:629 and crashing the entire system. No public exploit code has been identified; the bug was surfaced by syzbot kernel fuzzing.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

NULL pointer dereference in the Linux kernel's vidtv virtual DVB-T test driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service. The flaw resides in vidtv_channel_pmt_match_sections(), which calls vidtv_psi_pmt_stream_init() without validating whether the return value is NULL on memory allocation failure; a subsequent field access on the NULL pointer triggers a general protection fault. No public exploit or active KEV-listed exploitation exists; EPSS at 0.02% (5th percentile) reflects negligible real-world exploitation probability.

RemediationAI

Upgrade to a patched stable kernel release: 6.12.83 or later in the 6.12 series, 6.18.24 or later in the 6.18 series, 6.19.14 or later in the 6.19 series, or 7.0.1 or later in the 7.0 series. Fixes are available from the kernel stable tree at https://git.kernel.org/stable/c/e589de36da106ef739ba98f66f5a5c2023370706 and sibling commits. Ubuntu users should apply USN-8488-1 via standard package updates (https://ubuntu.com/security/notices/USN-8488-1). As a compensating control on systems that cannot immediately patch, unload or blacklist the vidtv module (echo 'blacklist vidtv' >> /etc/modprobe.d/blacklist.conf) - this eliminates the attack surface entirely with no functional impact on production workloads since vidtv is a test-only driver. Server and production kernels built without CONFIG_DVB_VIDTV are not affected and require no action.

Affected VersionsENISA

Linux patch: 7.0.1
Linux patch: 6.18.24
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <b832cfd516b8504e95884622cee60bf9a39b7945
Linux patch: 6.12.83
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <07c1e474cf9acf777f09d14a8f8dfcef5b84e46f
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2dff11fb5098ae453651f8f77e94ad499c078022
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e589de36da106ef739ba98f66f5a5c2023370706
Linux patch: 6.19.14

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code is in drivers/media/test-drivers/vidtv/, a virtual DVB-T (Digital Video Broadcasting - Terrestrial) test driver introduced to allow DVB subsystem testing without physical hardware. It implements PSI (Program Specific Information) table construction, including PMT (Program Map Table) streams. The root cause (CWE-476) is an unchecked return value: vidtv_psi_pmt_stream_init() returns NULL on kmalloc failure, and vidtv_channel_pmt_match_sections() immediately dereferences the result via &tail->descriptor, triggering a KASAN-detected null-ptr-deref at offset 0x00-0x07. The CPE cpe:2.3:a:linux:linux confirms this affects the mainline Linux kernel codebase. The call chain is: vidtv_start_feed → vidtv_start_streaming → vidtv_mux_init → vidtv_channel_si_init → vidtv_channel_pmt_match_sections → vidtv_psi_desc_assign (crash site at vidtv_psi.c:629). The fix adds a NULL check with cleanup of the already-allocated stream chain before returning.

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local-only vector, low privilege to access DVB device, pure availability impact via kernel crash; no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Apr 29, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 29, 2026 - 20:12 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
CVE Published
Apr 24, 2026 - 14:42 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

syzbot reported a general protection fault in vidtv_psi_desc_assign [1].

vidtv_psi_pmt_stream_init() can return NULL on memory allocation failure, but vidtv_channel_pmt_match_sections() does not check for this. When tail is NULL, the subsequent call to vidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL pointer offset, causing a general protection fault.

Add a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean up the already-allocated stream chain and return.

[1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629 Call Trace: <TASK> vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline] vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479 vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline] vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Prevalence
Low
Linux kernel test driver, absent from production and server builds
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-31599 ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://vuldb.com/vuln/359434 REF https://git.kernel.org/stable/c/07c1e474cf9acf777f09d14a8f8dfcef5b84e46f REF https://git.kernel.org/stable/c/2dff11fb5098ae453651f8f77e94ad499c078022 REF https://git.kernel.org/stable/c/54e18a23e62e81b8335cec3e8e9c5cb33fd88665 REF https://git.kernel.org/stable/c/5c986b77200b5ea754ba6636deacc7e0942fec9b REF https://git.kernel.org/stable/c/93d9e747a9e8a5ca9e3c5e37dcff76b40399139f REF https://git.kernel.org/stable/c/b7efb4c94797c504a1c678edb48c2aa311d3309f REF https://git.kernel.org/stable/c/b832cfd516b8504e95884622cee60bf9a39b7945 REF https://git.kernel.org/stable/c/e589de36da106ef739ba98f66f5a5c2023370706 REF https://git.kernel.org/stable/c/f8e1fc918a9fe67103bcda01d20d745f264d00a7

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy