CVE-2026-43058 media: vidtv: fix pass-by-value structs causing MSAN warnings
A bug in the Linux kernel vidtv driver caused uninitialized value warnings, potentially leading to denial of service, fixed by passing structs by pointer.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43058?
CVE-2026-43058 is a medium-severity vulnerability in Linux kernel, published on 2 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: fix pass-by-value structs causing MSAN warnings
vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their argument structs by value, causing MSAN to report uninit-value warnings. While only vidtv_ts_null_write_into() has triggered a report so far, both functions share the same issue.
Fix by passing both structs by const pointer instead, avoiding the stack copy of the struct along with its MSAN shadow and origin metadata. The functions do not modify the structs, which is enforced by the const qualifier.
Weakness: CWE-476
Which versions are affected by CVE-2026-43058?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43058?
Apply the vendor's patch.
Is CVE-2026-43058 being exploited?
There is no known exploitation of CVE-2026-43058 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43058, DEBIAN-CVE-2026-43058, GHSA-2xpr-gh65-3jvf, ROOT-OS-DEBIAN-11-CVE-2026-43058, ROOT-OS-DEBIAN-12-CVE-2026-43058, ROOT-OS-UBUNTU-2204-CVE-2026-43058 and 2 more.