CVE-2026-43058

What it actually does

This is a local Linux kernel availability issue in the media vidtv driver. Two vidtv transport-stream helper functions accepted structs by value, which could copy uninitialized stack data and associated sanitizer metadata, producing MemorySanitizer uninitialized-value reports and potentially triggering kernel instability in vulnerable builds or configurations. The CVSS vector indicates local access is required, privileges are required, no user interaction is needed, and the primary impact is availability rather than confidentiality or integrity.

Why it matters to the business

Successful exploitation could disrupt Linux systems that include and expose the affected vidtv kernel functionality, potentially causing service interruption or system instability. The risk is moderated by the need for local authenticated access, the lack of known public exploit maturity, low EPSS probability, and the fact that it is not listed in CISA KEV or associated with ransomware campaigns; however, shared Linux infrastructure should still treat kernel availability flaws as operationally important because crashes can affect workloads running on the host.

How an attack unfolds

An attacker first obtains local access to a Linux system with sufficient privileges to interact with the affected media/vidtv kernel functionality. They then exercise the vulnerable vidtv code paths that call vidtv_ts_null_write_into() or vidtv_ts_pcr_write_into(), causing the kernel to pass affected structs by value and copy uninitialized state. In vulnerable configurations, this may trigger sanitizer-detected uninitialized-value behavior, kernel warnings, instability, or a denial-of-service condition. There is no indication from the provided intelligence that this flaw is remotely exploitable, used in the wild, or currently weaponized by named threat actors.

How to fix it

Apply a Linux kernel update that includes the upstream vidtv fix changing the affected helper arguments from pass-by-value to const pointer. Because no exact fixed package versions were provided, use the patched kernel versions supplied by the relevant Linux distribution, appliance vendor, cloud image provider, or kernel maintenance stream. If immediate patching is not possible, reduce exposure by disabling or not loading unnecessary media test drivers such as vidtv where operationally feasible, restricting local shell access to trusted administrators, and enforcing least privilege for users who can interact with media devices or load kernel modules.

How to confirm the fix worked

Confirm the running kernel has been updated to a vendor build that includes the vidtv pass-by-const-pointer fix. Validate that package changelogs or kernel source patches reference the vidtv fixes for vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into(). Check whether the vidtv module is present or loaded using standard kernel module inventory commands, and confirm it is disabled if not required. For systems built with sanitizers or debug kernels, reproduce prior media/vidtv test coverage and verify that MemorySanitizer uninitialized-value warnings no longer appear for the affected functions.

Typical attack path

1. Gain local access to a Linux system with the affected kernel and vidtv functionality present.
2. Confirm that the vidtv media test driver or vulnerable code path is available.
3. Invoke media/vidtv operations that reach vidtv_ts_null_write_into() or vidtv_ts_pcr_write_into().
4. Trigger the uninitialized-value condition caused by pass-by-value struct copying.
5. Cause kernel warning, sanitizer failure, instability, or denial of service depending on build and runtime configuration.

How to detect it

Review kernel logs, system journals, crash dumps, and sanitizer output for evidence of prior kernel instability involving the vidtv media driver. Useful sources include dmesg, journald kernel facility logs, /var/log/kern.log, /var/log/messages, crash dump directories, kdump/vmcore artifacts, and CI or test logs for sanitizer-enabled kernels. Look for MemorySanitizer or uninitialized-value reports that include vidtv_ts_null_write_into(), vidtv_ts_pcr_write_into(), the vidtv module, or drivers/media/test-drivers/vidtv paths. Also correlate unexpected reboots, kernel panics, BUG/WARNING splats, or oops traces with local user activity or media-device interactions. There are no provided public exploitation indicators, named threat actors, ransomware links, or KEV evidence, so detection should focus on local kernel crash artifacts rather than network indicators.

• vidtv_ts_null_write_into
• vidtv_ts_pcr_write_into
• drivers/media/test-drivers/vidtv
• MemorySanitizer: use-of-uninitialized-value
• uninit-value
• vidtv

What your security team should do

• Prioritize patching Linux hosts that allow local user access, run debug/sanitizer kernels, expose media test-driver functionality, or support multi-user workloads.
• Inventory systems where the vidtv module or media test drivers are available, loaded, or packaged into the running kernel.
• If patching must be delayed, disable or block loading of unnecessary vidtv/media test-driver modules and limit local user privileges.
• Monitor kernel logs for crashes, warnings, or sanitizer reports mentioning vidtv_ts_null_write_into(), vidtv_ts_pcr_write_into(), or vidtv.
• Do not treat this as an internet-facing remote-code-execution emergency based on the provided data, but include it in routine kernel maintenance because kernel DoS issues can still cause outages.