CVE-2026-31583

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: em28xx: fix use-after-free in em28xx_v4l2_open()<br /> <br /> em28xx_v4l2_open() reads dev-&gt;v4l2 without holding dev-&gt;lock,<br /> creating a race with em28xx_v4l2_init()&amp;#39;s error path and<br /> em28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct<br /> and set dev-&gt;v4l2 to NULL under dev-&gt;lock.<br /> <br /> This race leads to two issues:<br /> - use-after-free in v4l2_fh_init() when accessing vdev-&gt;ctrl_handler,<br /> since the video_device is embedded in the freed em28xx_v4l2 struct.<br /> - NULL pointer dereference in em28xx_resolution_set() when accessing<br /> v4l2-&gt;norm, since dev-&gt;v4l2 has been set to NULL.<br /> <br /> Fix this by moving the mutex_lock() before the dev-&gt;v4l2 read and<br /> adding a NULL check for dev-&gt;v4l2 under the lock.