In the Linux kernel, the following vulnerability has been resolved:
media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
In hackrf driver, the following race condition occurs:
```
CPU0 CPU1
hackrf_probe()
kzalloc(); // alloc hackrf_dev
....
v4l2_device_register();
....
fd = sys_open("/path/to/dev"); // open hackrf fd
....
v4l2_device_unregister();
....
kfree(); // free hackrf_dev
....
sys_ioctl(fd, ...);
v4l2_ioctl();
video_is_registered() // UAF!!
....
sys_close(fd);
v4l2_release() // UAF!!
hackrf_video_release()
kfree(); // DFB!!
```
When a V4L2 or video device is unregistered, the device node is removed so
new open() calls are blocked.
However, file descriptors that are already open-and any in-flight I/O-do
not terminate immediately; they remain valid until the last reference is
dropped and the driver's release() is invoked.
Therefore, freeing device memory on the error path after hackrf_probe()
has registered dev it will lead to a race to use-after-free vuln, since
those already-open handles haven't been released yet.
And since release() free memory too, race to use-after-free and
double-free vuln occur.
To prevent this, if device is registered from probe(), it should be
modified to free memory only through release() rather than calling
kfree() directly.
References
Configurations
Configuration 1 (hide)
|
History
27 Apr 2026, 20:40
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| References | () https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824 - Patch | |
| References | () https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848 - Patch | |
| References | () https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258 - Patch | |
| References | () https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0 - Patch | |
| References | () https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9 - Patch | |
| References | () https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2 - Patch |
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Apr 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-24 15:16
Updated : 2026-04-27 20:40
NVD link : CVE-2026-31576
Mitre link : CVE-2026-31576
CVE.ORG link : CVE-2026-31576
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free