The Linux kernel's vidtv media subsystem had a vulnerability where local pointers were not set to NULL after transferring ownership of memory to PAT/SDT/EIT tables. Specifically, vidtv_channel_si_init() creates temporary lists whose ownership is transferred via vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), and vidtv_psi_eit_event_assign(). Failure to initialize these local pointers to NULL leads to the vidtv_psi_pmt_create_sec_for_each_pat_entry() function failing and subsequently causes double-free conditions when memory freed by vidtv_psi_*_table_destroy() is accessed again by vidtv_psi_*_event_destroy(). This results in use-after-free and double-free vulnerabilities. The fix involves initializing local pointers to NULL upon memory ownership transfer to prevent these unsafe memory operations.

The vulnerability can lead to use-after-free and double-free conditions in the Linux kernel's vidtv media subsystem, potentially causing memory corruption. This can result in system instability, crashes, or escalation of privileges due to corrupted kernel memory. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges and no user interaction, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.