CVE-2026-31573
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
24/04/2026
Last modified:
27/04/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
media: verisilicon: Fix kernel panic due to __initconst misuse<br />
<br />
Fix a kernel panic when probing the driver as a module:<br />
<br />
Unable to handle kernel paging request at virtual address<br />
ffffd9c18eb05000<br />
of_find_matching_node_and_match+0x5c/0x1a0<br />
hantro_probe+0x2f4/0x7d0 [hantro_vpu]<br />
<br />
The imx8mq_vpu_shared_resources array is referenced by variant<br />
structures through their shared_devices field. When built as a<br />
module, __initconst causes this data to be freed after module<br />
init, but it&#39;s later accessed during probe, causing a page fault.<br />
<br />
The imx8mq_vpu_shared_resources is referenced from non-init code,<br />
so keeping __initconst or __initconst_or_module here is wrong.<br />
<br />
Drop the __initconst annotation and let it live in the normal .rodata<br />
section.<br />
<br />
A bug of __initconst called from regular non-init probe code<br />
leading to bugs during probe deferrals or during unbind-bind cycles.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19.6 (including) | 6.19.11 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



