Bug 2464629 (CVE-2026-43058)

Summary:	CVE-2026-43058 kernel: media: vidtv: fix pass-by-value structs causing MSAN warnings
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's `vidtv` media component. This issue arises from functions incorrectly passing data structures by value, which can lead to MemorySanitizer (MSAN) reporting uninitialized value warnings. Such warnings indicate a risk of memory corruption or undefined behavior, which could potentially be exploited by a local attacker to impact system stability or integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-02 07:01:28 UTC

In the Linux kernel, the following vulnerability has been resolved:

media: vidtv: fix pass-by-value structs causing MSAN warnings

vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their
argument structs by value, causing MSAN to report uninit-value warnings.
While only vidtv_ts_null_write_into() has triggered a report so far,
both functions share the same issue.

Fix by passing both structs by const pointer instead, avoiding the
stack copy of the struct along with its MSAN shadow and origin metadata.
The functions do not modify the structs, which is enforced by the const
qualifier.

Comment 1 Alexander B 2026-05-04 07:15:23 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050254-CVE-2026-43058-4a86@gregkh/T