CVE-2026-31585

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: vidtv: fix nfeeds state corruption on start_streaming failure

syzbot reported a memory leak in vidtv_psi_service_desc_init [1].

When vidtv_start_streaming() fails inside vidtv_start_feed(), the

nfeeds counter is left incremented even though no feed was actually

started. This corrupts the driver state: subsequent start_feed calls

see nfeeds > 1 and skip starting the mux, while stop_feed calls

eventually try to stop a non-existent stream.

This state corruption can also lead to memory leaks, since the mux

and channel resources may be partially allocated during a failed

start_streaming but never cleaned up, as the stop path finds

dvb->streaming == false and returns early.

Fix by decrementing nfeeds back when start_streaming fails, keeping

the counter in sync with the actual number of active feeds.

[1]

BUG: memory leak

unreferenced object 0xffff888145b50820 (size 32):

comm "syz.0.17", pid 6068, jiffies 4294944

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References