CVE-2026-31576

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31576", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.119Z", "datePublished": "2026-04-24T14:42:08.188Z", "dateUpdated": "2026-06-14T17:42:00.110Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T17:42:00.110Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()\n\nIn hackrf driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // alloc hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // free hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a V4L2 or video device is unregistered, the device node is removed so\nnew open() calls are blocked.\n\nHowever, file descriptors that are already open-and any in-flight I/O-do\nnot terminate immediately; they remain valid until the last reference is\ndropped and the driver's release() is invoked.\n\nTherefore, freeing device memory on the error path after hackrf_probe()\nhas registered dev it will lead to a race to use-after-free vuln, since\nthose already-open handles haven't been released yet.\n\nAnd since release() free memory too, race to use-after-free and\ndouble-free vuln occur.\n\nTo prevent this, if device is registered from probe(), it should be\nmodified to free memory only through release() rather than calling\nkfree() directly."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/hackrf/hackrf.c"], "versions": [{"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "lessThan": "87b9685cca91ed715c39ba544715832d26a7f4b4", "status": "affected", "versionType": "git"}, {"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "lessThan": "131ec9046e1c8af101aebdaec4e8095e05f3312b", "status": "affected", "versionType": "git"}, {"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "lessThan": "67fd62e3efdc9dce01f76d95a745212f4feb38e6", "status": "affected", "versionType": "git"}, {"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "lessThan": "45cbaf5c7cdc5386d86377f0daf94a17a007fed0", "status": "affected", "versionType": "git"}, {"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "lessThan": "98a0a81ce78020c2522e0046f49d200de9778cb9", "status": "affected", "versionType": "git"}, {"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "lessThan": "07e9e674b6146b1f6fc41b1f54b8968bf2802824", "status": "affected", "versionType": "git"}, {"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "lessThan": "2145c71a8044362e82e9923f001ba2aeb771b848", "status": "affected", "versionType": "git"}, {"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "lessThan": "fcd1d70792a35c8a97414fe429f48311e41269c2", "status": "affected", "versionType": "git"}, {"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "lessThan": "3b7da2b4d0fe014eff181ed37e3bf832eb8ed258", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/hackrf/hackrf.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.1", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4"}, {"url": "https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b"}, {"url": "https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6"}, {"url": "https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0"}, {"url": "https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9"}, {"url": "https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824"}, {"url": "https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848"}, {"url": "https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2"}, {"url": "https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258"}], "title": "media: hackrf: fix to not free memory after the device is registered in hackrf_probe()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/usb/hackrf/hackrf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "87b9685cca91ed715c39ba544715832d26a7f4b4", "status": "affected", "version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "versionType": "git"}, {"lessThan": "131ec9046e1c8af101aebdaec4e8095e05f3312b", "status": "affected", "version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "versionType": "git"}, {"lessThan": "67fd62e3efdc9dce01f76d95a745212f4feb38e6", "status": "affected", "version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "versionType": "git"}, {"lessThan": "45cbaf5c7cdc5386d86377f0daf94a17a007fed0", "status": "affected", "version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "versionType": "git"}, {"lessThan": "98a0a81ce78020c2522e0046f49d200de9778cb9", "status": "affected", "version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "versionType": "git"}, {"lessThan": "07e9e674b6146b1f6fc41b1f54b8968bf2802824", "status": "affected", "version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "versionType": "git"}, {"lessThan": "2145c71a8044362e82e9923f001ba2aeb771b848", "status": "affected", "version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "versionType": "git"}, {"lessThan": "fcd1d70792a35c8a97414fe429f48311e41269c2", "status": "affected", "version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "versionType": "git"}, {"lessThan": "3b7da2b4d0fe014eff181ed37e3bf832eb8ed258", "status": "affected", "version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/usb/hackrf/hackrf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "14109CEF-714B-4029-A318-97AA58A01833", "versionEndExcluding": "6.6.136", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()\n\nIn hackrf driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // alloc hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // free hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a V4L2 or video device is unregistered, the device node is removed so\nnew open() calls are blocked.\n\nHowever, file descriptors that are already open-and any in-flight I/O-do\nnot terminate immediately; they remain valid until the last reference is\ndropped and the driver's release() is invoked.\n\nTherefore, freeing device memory on the error path after hackrf_probe()\nhas registered dev it will lead to a race to use-after-free vuln, since\nthose already-open handles haven't been released yet.\n\nAnd since release() free memory too, race to use-after-free and\ndouble-free vuln occur.\n\nTo prevent this, if device is registered from probe(), it should be\nmodified to free memory only through release() rather than calling\nkfree() directly."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: hackrf: correcci\u00f3n para no liberar memoria despu\u00e9s de que el dispositivo es registrado en hackrf_probe()\n\nEn el controlador hackrf, la siguiente condici\u00f3n de carrera ocurre:\n\u201d\u201d\u201c\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // asigna hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(\u201c/path/to/dev\u201d); // abre el descriptor de archivo hackrf\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // libera hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // \u00a1\u00a1UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // \u00a1\u00a1UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // \u00a1\u00a1DFB!!\n\u201d\u201d\u201d\n\nCuando un dispositivo V4L2 o de video es dado de baja, el nodo del dispositivo es eliminado, por lo que las nuevas llamadas a open() son bloqueadas.\n\nSin embargo, los descriptores de archivo que ya est\u00e1n abiertos -y cualquier E/S en curso- no terminan inmediatamente; permanecen v\u00e1lidos hasta que la \u00faltima referencia es liberada y se invoca el release() del controlador.\n\nPor lo tanto, liberar la memoria del dispositivo en la ruta de error despu\u00e9s de que hackrf_probe() ha registrado el dispositivo conducir\u00e1 a una condici\u00f3n de carrera de vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n, ya que esos manejadores ya abiertos a\u00fan no han sido liberados.\n\nY dado que release() tambi\u00e9n libera memoria, ocurren una condici\u00f3n de carrera de uso despu\u00e9s de liberaci\u00f3n y una vulnerabilidad de doble liberaci\u00f3n.\n\nPara evitar esto, si el dispositivo es registrado desde probe(), deber\u00eda modificarse para liberar memoria solo a trav\u00e9s de release() en lugar de llamar a kfree() directamente."}], "id": "CVE-2026-31576", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:32.230", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: media: hackrf: fix to not free memory after the device is registered in hackrf_probe()", "id": "2461445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461445"}, "csaw": false, "cwe": "CWE-364", "details": ["A flaw was found in the Linux kernel's hackrf driver. A race condition exists where memory for the hackrf device is freed prematurely during device unregistration, even when file descriptors are still in use. This allows a local user to trigger a use-after-free and double-free vulnerability. Successful exploitation can lead to system instability, crashes, or a denial of service."], "name": "CVE-2026-31576", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31576\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31576\nhttps://lore.kernel.org/linux-cve-announce/2026042410-CVE-2026-31576-e770@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8bc4a9ed85046c214458c9e82aea75d2f46cfffd,45cbaf5c7cdc5386d86377f0daf94a17a007fed0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8bc4a9ed85046c214458c9e82aea75d2f46cfffd,98a0a81ce78020c2522e0046f49d200de9778cb9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8bc4a9ed85046c214458c9e82aea75d2f46cfffd,07e9e674b6146b1f6fc41b1f54b8968bf2802824)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8bc4a9ed85046c214458c9e82aea75d2f46cfffd,2145c71a8044362e82e9923f001ba2aeb771b848)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8bc4a9ed85046c214458c9e82aea75d2f46cfffd,fcd1d70792a35c8a97414fe429f48311e41269c2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8bc4a9ed85046c214458c9e82aea75d2f46cfffd,3b7da2b4d0fe014eff181ed37e3bf832eb8ed258)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.83,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.1,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T14:08:11.671007+00:00", "value": {"mitigation_remediation": ["Apply the latest kernel patch that removes the premature kfree in hackrf_probe() and rebuild or update the kernel.", "If the patch cannot be applied immediately, disable or block the hackrf driver (e.g., by blacklisting the module or preventing /dev/hackrf from being created).", "After applying the patch or disabling the driver, stop all processes that have opened /dev/hackrf and restart them to ensure no lingering file descriptors remain."], "summary": {"action": "Immediate Patch", "impact": "Use\u2011After\u2011Free / Double\u2011Free causing kernel memory corruption or code execution"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that include the hackrf driver are affected; any kernel version before the patch that removes the premature kfree call in hackrf_probe() is vulnerable. The flaw exists on any host where the hackrf driver is loaded and the /dev/hackrf device is exposed to userspace. Administrators should verify whether the hackrf module is in use on each system.", "description_and_impact": "In the Linux kernel\u2019s hackrf media driver, a race condition allows memory allocated for the hackrf_dev structure to be freed while still referenced by open file descriptors. This premature free produces a use\u2011after\u2011free followed by a double\u2011free on device unregister and release, enabling kernel memory corruption, system crashes, or arbitrary code execution. The weakness is classified as a race condition and memory safety violation (CWE\u2011364, CWE\u2011416).", "risk_and_exploitability": "The CVSS score of 7.8 marks this as high severity, and an EPSS score of less than\u202f1\u202f% indicates a low but non\u2011zero likelihood of exploitation. The issue requires a local attacker with access to the /dev/hackrf device to open it during the probe/unregister race, potentially leading to kernel memory corruption or privilege escalation. Although it is not currently listed in CISA\u2019s KEV catalog, the presence of a race condition warrants prompt mitigation."}}}}, "created": "2026-04-27T19:00:15.728711+00:00", "updated": "2026-04-28T14:15:34.911029+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}