CVE-2026-31599: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31599 is a NULL pointer dereference vulnerability in the Linux kernel's vidtv (virtual digital TV) media test driver, specifically in the vidtv_channel_pmt_match_sections() function. It was published on April 24, 2026, and affects Linux kernel versions from 5.10 through multiple stable branches up to 6.19.13 and 7.0.0. The flaw was discovered via syzbot fuzzing and reported through the kernel's standard security disclosure process. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is a missing NULL return value check after calling vidtv_psi_pmt_stream_init(), classified as CWE-476 (NULL Pointer Dereference). When memory allocation fails inside vidtv_psi_pmt_stream_init(), it returns NULL, but vidtv_channel_pmt_match_sections() proceeds to pass &tail->descriptor to vidtv_psi_desc_assign(), dereferencing the NULL pointer and triggering a general protection fault (GPF). The fault manifests at vidtv_psi.c:629 in the call chain: vidtv_start_feed → vidtv_start_streaming → vidtv_mux_init → vidtv_channel_si_init → vidtv_channel_pmt_match_sections. The fix adds a NULL check after vidtv_psi_pmt_stream_init() and properly cleans up already-allocated stream chain resources on failure (GitHub Advisory).

Successful exploitation causes a kernel crash (general protection fault), resulting in a denial of service condition on the affected system. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because the vidtv driver is a test/debug driver, the practical impact is confined to systems where this module is loaded, which is uncommon in production environments (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation. The vulnerability requires local access with low privileges and no user interaction. The EPSS score is approximately 0.014% (3rd percentile), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Precondition: Obtain local access to a system running a vulnerable Linux kernel version (5.10–6.6.135, 6.7–6.12.82, 6.13–6.18.23, 6.19.0–6.19.13, or 7.0.0) with the vidtv test driver module loaded.
2. Verify driver presence: Confirm the vidtv module is loaded using lsmod | grep vidtv.
3. Trigger streaming initialization: Initiate a streaming operation through the vidtv driver interface (e.g., via DVB API calls to vidtv_start_feed), which internally calls vidtv_mux_init → vidtv_channel_si_init → vidtv_channel_pmt_match_sections.
4. Induce memory pressure: Cause or wait for a memory allocation failure in vidtv_psi_pmt_stream_init(), which returns NULL under low-memory conditions.
5. Trigger NULL dereference: The unguarded NULL pointer is passed to vidtv_psi_desc_assign(), causing a general protection fault and kernel crash (denial of service) (GitHub Advisory, Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg containing general protection fault and KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007].
• Logs: Stack traces referencing vidtv_psi_desc_assign+0x24/0x90, vidtv_channel_pmt_match_sections, vidtv_channel_si_init, vidtv_mux_init, or vidtv_start_feed in kernel logs.
• Process: Unexpected system reboots or kernel panics on systems with the vidtv module loaded.
• File System: Presence of the vidtv kernel module on production systems where it is not expected (/sys/module/vidtv or output of lsmod) (GitHub Advisory).

Apply kernel updates to the following fixed versions based on your branch: 6.6.136+, 6.12.83+, 6.18.24+, 6.19.14+, or 7.0.1+. Multiple patch commits are available at git.kernel.org. As an immediate workaround on systems not requiring the vidtv driver, unload the module with modprobe -r vidtv and blacklist it to prevent reloading. Restrict local user access on systems where the module must remain loaded (GitHub Advisory, Red Hat Bugzilla).