{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31573", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.119Z", "datePublished": "2026-04-24T14:35:51.421Z", "dateUpdated": "2026-05-11T22:11:24.118Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:11:24.118Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: Fix kernel panic due to __initconst misuse\n\nFix a kernel panic when probing the driver as a module:\n\n Unable to handle kernel paging request at virtual address\n ffffd9c18eb05000\n of_find_matching_node_and_match+0x5c/0x1a0\n hantro_probe+0x2f4/0x7d0 [hantro_vpu]\n\nThe imx8mq_vpu_shared_resources array is referenced by variant\nstructures through their shared_devices field. When built as a\nmodule, __initconst causes this data to be freed after module\ninit, but it's later accessed during probe, causing a page fault.\n\nThe imx8mq_vpu_shared_resources is referenced from non-init code,\nso keeping __initconst or __initconst_or_module here is wrong.\n\nDrop the __initconst annotation and let it live in the normal .rodata\nsection.\n\nA bug of __initconst called from regular non-init probe code\nleading to bugs during probe deferrals or during unbind-bind cycles."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"], "versions": [{"version": "286d629d10640bc22f3bf46aa4f356eb7975e862", "lessThan": "1e7e9119cf9b0d8585b27653b1a6dc31397c252e", "status": "affected", "versionType": "git"}, {"version": "e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765", "lessThan": "e8d97c270cb46a2a88739019d0f8547adc7d97da", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"], "versions": [{"version": "6.19.6", "lessThan": "6.19.11", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.6", "versionEndExcluding": "6.19.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1e7e9119cf9b0d8585b27653b1a6dc31397c252e"}, {"url": "https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}], "title": "media: verisilicon: Fix kernel panic due to __initconst misuse", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BFE33C3-C605-4CC2-9F15-3494BA78E2C9", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: Fix kernel panic due to __initconst misuse\n\nFix a kernel panic when probing the driver as a module:\n\n Unable to handle kernel paging request at virtual address\n ffffd9c18eb05000\n of_find_matching_node_and_match+0x5c/0x1a0\n hantro_probe+0x2f4/0x7d0 [hantro_vpu]\n\nThe imx8mq_vpu_shared_resources array is referenced by variant\nstructures through their shared_devices field. When built as a\nmodule, __initconst causes this data to be freed after module\ninit, but it's later accessed during probe, causing a page fault.\n\nThe imx8mq_vpu_shared_resources is referenced from non-init code,\nso keeping __initconst or __initconst_or_module here is wrong.\n\nDrop the __initconst annotation and let it live in the normal .rodata\nsection.\n\nA bug of __initconst called from regular non-init probe code\nleading to bugs during probe deferrals or during unbind-bind cycles."}], "id": "CVE-2026-31573", "lastModified": "2026-04-27T20:29:52.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:31.857", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1e7e9119cf9b0d8585b27653b1a6dc31397c252e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: media: verisilicon: Fix kernel panic due to __initconst misuse", "id": "2461493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461493"}, "csaw": false, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's verisilicon hantro_vpu media driver. When the driver is built as a module, a misuse of the __initconst annotation causes data to be prematurely freed. This freed memory is later accessed during driver probing or unbind-bind cycles, leading to a kernel panic and a Denial of Service (DoS) condition. A local attacker could potentially trigger this flaw by loading and unloading the affected module."], "name": "CVE-2026-31573", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31573\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31573\nhttps://lore.kernel.org/linux-cve-announce/2026042403-CVE-2026-31573-4d0a@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[286d629d10640bc22f3bf46aa4f356eb7975e862,1e7e9119cf9b0d8585b27653b1a6dc31397c252e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765,e8d97c270cb46a2a88739019d0f8547adc7d97da)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.6,6.19.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T14:09:11.156512+00:00", "value": {"mitigation_remediation": ["Apply the latest kernel release that removes the __initconst annotation from the Verisilicon media driver.", "If a kernel update cannot be performed immediately, disable or uninstall the hantro_vpu module to prevent accidental loading.", "Audit other kernel modules for misuse of __initconst or similar initialization attributes to avoid repeat issues."], "summary": {"action": "Patch", "impact": "Kernel Panic (Denial of Service)"}, "threat_synthesis": {"affected_systems": "Affected only the Linux kernel media subsystem for Verisilicon devices. No specific kernel version range is listed, but any configuration that loads the hantro_vpu module remains vulnerable until the upstream fix is applied.", "description_and_impact": "The vulnerability arises from improper use of the __initconst attribute in the Verisilicon media driver within the Linux kernel, leading to a kernel paging request error when the driver is probed as a module. This causes a kernel panic, effectively crashing the system and denying service. The flaw is an example of CWE\u2011825, improper handling of data with incorrect lifetime annotations.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not in the CISA KEV list. Attack feasibility requires the ability to load or reload the affected module, which typically requires administrative privileges or a local physical user with the ability to insert kernel modules. In such environments, an attacker could crash the system by triggering the probe sequence."}}}}, "created": "2026-04-27T19:00:15.749864+00:00", "updated": "2026-04-28T14:15:34.914809+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}