CVE-2026-43058: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43058 is a Linux kernel vulnerability in the media/vidtv subsystem where vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() pass argument structs by value instead of by pointer, causing Memory Sanitizer (MSAN) to report uninitialized value warnings that can lead to a denial of service. The vulnerability affects Linux kernel versions 5.10 through 6.6.135, 6.7 through 6.12.82, 6.13 through 6.18.23, 6.19 through 6.19.13, and 7.0 through 7.0.0. It was published on May 2, 2026, with patches added to stable branches by May 26, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified under CWE-824 (Access of Uninitialized Pointer) and CWE-476 (NULL Pointer Dereference). When vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() receive their argument structs by value, the stack copy of the struct includes uninitialized padding or fields, which MSAN flags as uninit-value accesses — potentially leading to kernel instability or a crash. The fix changes both functions to accept their arguments via const pointer, eliminating the problematic stack copy and its associated MSAN shadow/origin metadata issues. Exploitation requires local access with low privileges and no user interaction (GitHub Advisory, Feedly).

A local user with low privileges can trigger the uninitialized value condition in the Linux kernel media subsystem, resulting in a kernel crash or system hang (denial of service). There is no impact on confidentiality or integrity — only availability is affected. The scope is limited to the local system, with no evidence of lateral movement potential or data exposure risk (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version in the applicable stable branch: 6.6.136 or later (5.10–6.6.x branch), 6.12.83 or later (6.7–6.12 branch), 6.18.24 or later (6.13–6.18 branch), 6.19.14 or later (6.19 branch), or 7.0.1 or later (7.0+ branch). No configuration-based workaround is documented; upgrading to a patched kernel is the recommended remediation. Linux distribution vendors including Red Hat and openSUSE have issued advisories tracking this fix (GitHub Advisory, Red Hat, openSUSE).

Red Hat tracked the issue via Bugzilla and published a security advisory, while openSUSE issued a security announcement to its mailing list. The vulnerability received routine coverage from vulnerability aggregators and security databases, with no notable researcher commentary or significant community discussion beyond standard disclosure channels (Red Hat, openSUSE).