CVE-2026-31599

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

syzbot reported a general protection fault in vidtv_psi_desc_assign [1].

vidtv_psi_pmt_stream_init() can return NULL on memory allocation

failure, but vidtv_channel_pmt_match_sections() does not check for

this. When tail is NULL, the subsequent call to

vidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL

pointer offset, causing a general protection fault.

Add a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean

up the already-allocated stream chain and return.

[1]

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

RIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629

Call Trace:

<TASK>

vidtv_channel_pmt_match_sections drivers/media/test-driver

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References