{"affected":[{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"4.20.1","lessThan":"5.10.253","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"5.11","lessThan":"5.15.203","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"5.16","lessThan":"6.1.168","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.2","lessThan":"6.6.131","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.7","lessThan":"6.12.80","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.13","lessThan":"6.18.21","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"greaterThanOrEqual":"6.19","lessThan":"6.19.11","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"status":"affected","version":"4.20","versionType":"custom"}]},{"conditional":false,"product":"linux_kernel","source":"NVD","vendor":"linux","versions":[{"status":"affected","version":"7.0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.253","versionStartIncluding":"4.20.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-31473","cwes":["CWE-416","CWE-362"],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex\n\nMEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)\nqueue teardown paths. This can race request object cleanup against vb2\nqueue cancellation and lead to use-after-free reports.\n\nWe already serialize request queueing against STREAMON/OFF with\nreq_queue_mutex. Extend that serialization to REQBUFS, and also take\nthe same mutex in media_request_ioctl_reinit() so REINIT is in the\nsame exclusion domain.\n\nThis keeps request cleanup and queue cancellation from running in\nparallel for request-capable devices.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.8,"severity":"high","source":"NVD: 416baaa9-dc9f-4396-8d5f-8c081fb06d67","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794438600263,"publishedAt":1776867403863,"references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56"}],"remediation":[{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1"},{"kind":"fix","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56"}],"revision":"c6f84586a10e1e8a9c6724f650535261ead8a6de82dbd8ce310722ffb49e0ab1","sources":[{"modifiedAt":1794438600263,"name":"NVD","retrievedAt":1794442700410,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31473"}],"ssvc":{"assessedAt":1792163393356,"automatable":"no","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"total"},"status":"published","title":"CVE-2026-31473","updatedAt":1794442700410}