In the Linux kernel, the following vulnerability has been resolved:
media: as102: fix to not free memory after the device is registered in as102_usb_probe()
In as102_usb driver, the following race condition occurs:
```
CPU0 CPU1
as102_usb_probe()
kzalloc(); // alloc as102_dev_t
....
usb_register_dev();
fd = sys_open("/path/to/dev"); // open as102 fd
....
usb_deregister_dev();
....
kfree(); // free as102_dev_t
....
sys_close(fd);
as102_release() // UAF!!
as102_usb_release()
kfree(); // DFB!!
```
When a USB character device registered with usb_register_dev() is later
unregistered (via usb_deregister_dev() or disconnect), the device node is
removed so new open() calls fail. However, file descriptors that are
already open do not go away immediately: they remain valid until the last
reference is dropped and the driver's .release() is invoked.
In as102, as102_usb_probe() calls usb_register_dev() and then, on an
error path, does usb_deregister_dev() and frees as102_dev_t right away.
If userspace raced a successful open() before the deregistration, that
open FD will later hit as102_release() --> as102_usb_release() and access
or free as102_dev_t again, occur a race to use-after-free and
double-free vuln.
The fix is to never kfree(as102_dev_t) directly once usb_register_dev()
has succeeded. After deregistration, defer freeing memory to .release().
In other words, let release() perform the last kfree when the final open
FD is closed.
References
Configurations
Configuration 1 (hide)
|
History
27 Apr 2026, 20:42
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Linux
Linux linux Kernel |
|
| References | () https://git.kernel.org/stable/c/09e9206008b887aa553733bd915d73131071a086 - Patch | |
| References | () https://git.kernel.org/stable/c/2eeae47a438694408189138048a786be99954032 - Patch | |
| References | () https://git.kernel.org/stable/c/582fbecb3756330006fe1950762412a68c2cacd2 - Patch | |
| References | () https://git.kernel.org/stable/c/7e5aedf6059cba2a669d86caeaf5a51f33ec85a1 - Patch | |
| References | () https://git.kernel.org/stable/c/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c - Patch | |
| References | () https://git.kernel.org/stable/c/cb8092038e95dc1113a68e63762de40fff61ba71 - Patch |
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Apr 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-24 15:16
Updated : 2026-04-27 20:42
NVD link : CVE-2026-31578
Mitre link : CVE-2026-31578
CVE.ORG link : CVE-2026-31578
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free