PT-2026-34937 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-06 · CVE-2026-31585

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak exists in the vidtv driver. When the vidtv start streaming() function fails within vidtv start feed(), the nfeeds counter remains incremented despite no feed being started. This results in state corruption where subsequent calls to start a feed skip starting the mux, and stop feed calls attempt to stop non-existent streams. Additionally, this corruption can lead to memory leaks because mux and channel resources may be partially allocated during a failed streaming start but are never cleaned up since the stop path returns early when dvb->streaming is false.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-31585

ECHO-7660-37E3-26E2

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 78

• https://security-tracker.debian.org/tracker/CVE-2026-31585 · Vendor Advisory
• https://git.kernel.org/stable/c/4bf95f797edd63c93330eafb6d6e670982344b9b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31585 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10703-1 · Vendor Advisory
• https://git.kernel.org/stable/c/98c22210aeadce67d9d20059f0dbbd01ba7fdbba · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31585 · Vendor Advisory
• https://git.kernel.org/stable/c/83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd · Patch
• https://git.kernel.org/stable/c/25f19e476ab15defe698504212899fdb9f7cd61b · Patch
• https://ubuntu.com/security/CVE-2026-31585 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31585 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-31585 · Vendor Advisory
• https://git.kernel.org/stable/c/17cb7957c979529cc98ff57f7ac331532f1f7c83 · Patch
• https://git.kernel.org/stable/c/a0e5a598fe9a4612b852406b51153b881592aede · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31585 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-31577 · Note