CVE-2026-31578

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31578", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.119Z", "datePublished": "2026-04-24T14:42:09.519Z", "dateUpdated": "2026-06-14T17:42:03.244Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T17:42:03.244Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: as102: fix to not free memory after the device is registered in as102_usb_probe()\n\nIn as102_usb driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n kzalloc(); // alloc as102_dev_t\n ....\n usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open as102 fd\n\t\t\t\t\t\t....\n usb_deregister_dev();\n ....\n kfree(); // free as102_dev_t\n ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t as102_release() // UAF!!\n\t\t\t\t\t\t as102_usb_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a USB character device registered with usb_register_dev() is later\nunregistered (via usb_deregister_dev() or disconnect), the device node is\nremoved so new open() calls fail. However, file descriptors that are\nalready open do not go away immediately: they remain valid until the last\nreference is dropped and the driver's .release() is invoked.\n\nIn as102, as102_usb_probe() calls usb_register_dev() and then, on an\nerror path, does usb_deregister_dev() and frees as102_dev_t right away.\nIf userspace raced a successful open() before the deregistration, that\nopen FD will later hit as102_release() --> as102_usb_release() and access\nor free as102_dev_t again, occur a race to use-after-free and\ndouble-free vuln.\n\nThe fix is to never kfree(as102_dev_t) directly once usb_register_dev()\nhas succeeded. After deregistration, defer freeing memory to .release().\n\nIn other words, let release() perform the last kfree when the final open\nFD is closed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/as102/as102_usb_drv.c"], "versions": [{"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "lessThan": "0d36653a3a821e5a974798adb347b3ea09332914", "status": "affected", "versionType": "git"}, {"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "lessThan": "25d500cf391e384356a612b85cf60b353ad3cd0c", "status": "affected", "versionType": "git"}, {"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "lessThan": "07ceb444c8f627cf863864d4274b5a77769725ed", "status": "affected", "versionType": "git"}, {"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "lessThan": "cb8092038e95dc1113a68e63762de40fff61ba71", "status": "affected", "versionType": "git"}, {"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "lessThan": "582fbecb3756330006fe1950762412a68c2cacd2", "status": "affected", "versionType": "git"}, {"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "lessThan": "09e9206008b887aa553733bd915d73131071a086", "status": "affected", "versionType": "git"}, {"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "lessThan": "2eeae47a438694408189138048a786be99954032", "status": "affected", "versionType": "git"}, {"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "lessThan": "7e5aedf6059cba2a669d86caeaf5a51f33ec85a1", "status": "affected", "versionType": "git"}, {"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "lessThan": "8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/as102/as102_usb_drv.c"], "versions": [{"version": "3.14", "status": "affected"}, {"version": "0", "lessThan": "3.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.1", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "7.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0d36653a3a821e5a974798adb347b3ea09332914"}, {"url": "https://git.kernel.org/stable/c/25d500cf391e384356a612b85cf60b353ad3cd0c"}, {"url": "https://git.kernel.org/stable/c/07ceb444c8f627cf863864d4274b5a77769725ed"}, {"url": "https://git.kernel.org/stable/c/cb8092038e95dc1113a68e63762de40fff61ba71"}, {"url": "https://git.kernel.org/stable/c/582fbecb3756330006fe1950762412a68c2cacd2"}, {"url": "https://git.kernel.org/stable/c/09e9206008b887aa553733bd915d73131071a086"}, {"url": "https://git.kernel.org/stable/c/2eeae47a438694408189138048a786be99954032"}, {"url": "https://git.kernel.org/stable/c/7e5aedf6059cba2a669d86caeaf5a51f33ec85a1"}, {"url": "https://git.kernel.org/stable/c/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c"}], "title": "media: as102: fix to not free memory after the device is registered in as102_usb_probe()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/usb/as102/as102_usb_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0d36653a3a821e5a974798adb347b3ea09332914", "status": "affected", "version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "versionType": "git"}, {"lessThan": "25d500cf391e384356a612b85cf60b353ad3cd0c", "status": "affected", "version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "versionType": "git"}, {"lessThan": "07ceb444c8f627cf863864d4274b5a77769725ed", "status": "affected", "version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "versionType": "git"}, {"lessThan": "cb8092038e95dc1113a68e63762de40fff61ba71", "status": "affected", "version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "versionType": "git"}, {"lessThan": "582fbecb3756330006fe1950762412a68c2cacd2", "status": "affected", "version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "versionType": "git"}, {"lessThan": "09e9206008b887aa553733bd915d73131071a086", "status": "affected", "version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "versionType": "git"}, {"lessThan": "2eeae47a438694408189138048a786be99954032", "status": "affected", "version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "versionType": "git"}, {"lessThan": "7e5aedf6059cba2a669d86caeaf5a51f33ec85a1", "status": "affected", "version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "versionType": "git"}, {"lessThan": "8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c", "status": "affected", "version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/usb/as102/as102_usb_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"lessThan": "3.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "14109CEF-714B-4029-A318-97AA58A01833", "versionEndExcluding": "6.6.136", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: as102: fix to not free memory after the device is registered in as102_usb_probe()\n\nIn as102_usb driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n kzalloc(); // alloc as102_dev_t\n ....\n usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open as102 fd\n\t\t\t\t\t\t....\n usb_deregister_dev();\n ....\n kfree(); // free as102_dev_t\n ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t as102_release() // UAF!!\n\t\t\t\t\t\t as102_usb_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a USB character device registered with usb_register_dev() is later\nunregistered (via usb_deregister_dev() or disconnect), the device node is\nremoved so new open() calls fail. However, file descriptors that are\nalready open do not go away immediately: they remain valid until the last\nreference is dropped and the driver's .release() is invoked.\n\nIn as102, as102_usb_probe() calls usb_register_dev() and then, on an\nerror path, does usb_deregister_dev() and frees as102_dev_t right away.\nIf userspace raced a successful open() before the deregistration, that\nopen FD will later hit as102_release() --> as102_usb_release() and access\nor free as102_dev_t again, occur a race to use-after-free and\ndouble-free vuln.\n\nThe fix is to never kfree(as102_dev_t) directly once usb_register_dev()\nhas succeeded. After deregistration, defer freeing memory to .release().\n\nIn other words, let release() perform the last kfree when the final open\nFD is closed."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: as102: correcci\u00f3n para no liberar memoria despu\u00e9s de que el dispositivo es registrado en as102_usb_probe()\n\nEn el controlador as102_usb, la siguiente condici\u00f3n de carrera ocurre:\n\u201d\u201d\u201c\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n kzalloc(); // alloc as102_dev_t\n ....\n usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(\u201c/path/to/dev\u201d); // open as102 fd\n\t\t\t\t\t\t....\n usb_deregister_dev();\n ....\n kfree(); // free as102_dev_t\n ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t as102_release() // UAF!!\n\t\t\t\t\t\t as102_usb_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n\u201d\u201d\u201d\n\nCuando un dispositivo de caracteres USB registrado con usb_register_dev() es posteriormente desregistrado (a trav\u00e9s de usb_deregister_dev() o desconexi\u00f3n), el nodo del dispositivo es eliminado por lo que las nuevas llamadas a open() fallan. Sin embargo, los descriptores de archivo que ya est\u00e1n abiertos no desaparecen inmediatamente: permanecen v\u00e1lidos hasta que la \u00faltima referencia es eliminada y se invoca el .release() del controlador.\n\nEn as102, as102_usb_probe() llama a usb_register_dev() y luego, en una ruta de error, hace usb_deregister_dev() y libera as102_dev_t de inmediato. Si el espacio de usuario compiti\u00f3 con un open() exitoso antes del desregistro, ese FD abierto posteriormente alcanzar\u00e1 as102_release() - as102_usb_release() y acceder\u00e1 o liberar\u00e1 as102_dev_t de nuevo, ocurrir\u00e1 una condici\u00f3n de carrera de uso despu\u00e9s de liberaci\u00f3n y una vulnerabilidad de doble liberaci\u00f3n.\n\nLa correcci\u00f3n es nunca kfree(as102_dev_t) directamente una vez que usb_register_dev() ha tenido \u00e9xito. Despu\u00e9s del desregistro, diferir la liberaci\u00f3n de memoria a .release().\n\nEn otras palabras, dejar que release() realice el \u00faltimo kfree cuando el FD abierto final es cerrado."}], "id": "CVE-2026-31578", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:32.480", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07ceb444c8f627cf863864d4274b5a77769725ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09e9206008b887aa553733bd915d73131071a086"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0d36653a3a821e5a974798adb347b3ea09332914"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25d500cf391e384356a612b85cf60b353ad3cd0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2eeae47a438694408189138048a786be99954032"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/582fbecb3756330006fe1950762412a68c2cacd2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e5aedf6059cba2a669d86caeaf5a51f33ec85a1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cb8092038e95dc1113a68e63762de40fff61ba71"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: media: as102: fix to not free memory after the device is registered in as102_usb_probe()", "id": "2461576", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461576"}, "csaw": false, "cwe": "CWE-364", "details": ["A flaw was found in the Linux kernel's as102_usb driver. A local user could exploit a race condition during the handling of USB device registration and deregistration. This vulnerability occurs when a device's memory is prematurely freed while an open file descriptor still exists, leading to a use-after-free or double-free condition. Such memory corruption could potentially allow for privilege escalation or cause a denial of service."], "name": "CVE-2026-31578", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31578\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31578\nhttps://lore.kernel.org/linux-cve-announce/2026042410-CVE-2026-31578-fd48@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c,cb8092038e95dc1113a68e63762de40fff61ba71)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c,582fbecb3756330006fe1950762412a68c2cacd2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c,09e9206008b887aa553733bd915d73131071a086)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c,2eeae47a438694408189138048a786be99954032)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c,7e5aedf6059cba2a669d86caeaf5a51f33ec85a1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c,8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.83,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.1,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:16:51.090348+00:00", "value": {"mitigation_remediation": ["Upgrade to a kernel version that includes the as102 USB driver patch (commit 09e9206) or a later release.", "If an upgrade is not immediately possible, apply the upstream patch to the kernel source and rebuild the affected modules or kernel.", "Reboot after patching to ensure the device node is removed immediately upon deregistration and the device structure is freed only after the last reference is released."], "summary": {"action": "Immediate Patch", "impact": "Use\u2011After\u2011Free and Double\u2011Free (memory corruption)"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to all Linux kernel builds that contain the as102 USB driver before the patch that changes the deallocation logic. The affected vendor is Linux Kernel, and all distributions based on it are impacted until they incorporate the upstream commit referenced in the advisory. No specific kernel version is listed; therefore any kernel that has not merged the documented fix remains vulnerable.", "description_and_impact": "This is a race condition in the Linux as102 USB character device driver that can trigger a use\u2011after\u2011free followed by a double\u2011free when the device is deregistered while file descriptors are still open. The flaw arises because the driver frees the device structure immediately after a failed deregistration path, even though the device node may still be referenced by user\u2011space handles. If a user opens the device between registration and deregistration, the subsequent close invokes the same deallocation, corrupting kernel memory. According to the CWE identifiers, this is a use\u2011after\u2011free (CWE\u2011416) and a double\u2011free (CWE\u2011364).", "risk_and_exploitability": "The CVSS score of 7.8 indicates a high impact for a local attacker with sufficient privileges or access to the USB device. The EPSS score of <1% suggests exploit attempts are currently rare, and the vulnerability is not yet listed in CISA\u2019s KEV catalog. The likely attack vector is a race condition triggered by inserting and removing the USB device while a local user has an open file descriptor on the device, which would result in memory corruption once the device is finally released. While the attack requires a local or privileged context and a specific race condition, the presence of the flaw warrants timely remediation."}}}}, "created": "2026-04-28T03:15:05.354763+00:00", "updated": "2026-04-28T20:30:06.170454+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}