Linux Kernel EUVD-2026-55305

The vivid driver (drivers/media/test-drivers/vivid/) is a virtual video capture and output device used primarily for kernel development and QA within the Linux media subsystem. The vulnerability exists in vivid_update_format_cap() and vivid_update_format_out(), which recalculate and apply format parameters whenever capability-related V4L2 controls (CROP, COMPOSE, SCALE) are toggled. These functions must only execute when the associated video buffer queue is idle, a condition normally enforced via vb2_is_busy(). However, in the lifecycle window between VIDIOC_REQBUFS - which allocates and configures queue memory - and VIDIOC_STREAMON - which locks controls - capability controls remain settable. Toggling them in this window triggers format recalculation on an already-provisioned queue without the vb2_is_busy() guard, causing the kernel to modify live queue state and potentially corrupt adjacent kernel structures. The root cause class is effectively a TOCTOU (time-of-check/time-of-use) race on queue-busy state within the V4L2 buffer management layer. CPE data (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) confirms the scope spans the Linux kernel broadly, with the vulnerability introduced at commit 73c3f48230cda01402ae189b05d56f1f7e0d53c9 and resolved across five separate stable-branch fix commits.