CVE-2026-31576
published 2026-04-24CVE-2026-31576: In the Linux kernel, the following vulnerability has been resolved: media: hackrf: fix to not free memory after the device is registered in hackrf_probe() In…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
In hackrf driver, the following race condition occurs:
```
CPU0 CPU1
hackrf_probe()
kzalloc(); // alloc hackrf_dev
....
v4l2_device_register();
....
fd = sys_open("/path/to/dev"); // open hackrf fd
....
v4l2_device_unregister();
....
kfree(); // free hackrf_dev
....
sys_ioctl(fd, ...);
v4l2_ioctl();
video_is_registered() // UAF!!
....
sys_close(fd);
v4l2_release() // UAF!!
hackrf_video_release()
kfree(); // DFB!!
```
When a V4L2 or video device is unregistered, the device node is removed so
new open() calls are blocked.
However, file descriptors that are already open-and any in-flight I/O-do
not terminate immediately; they remain valid until the last reference is
dropped and the driver's release() is invoked.
Therefore, freeing device memory on the error path after hackrf_probe()
has registered dev it will lead to a race to use-after-free vuln, since
those already-open handles haven't been released yet.
And since release() free memory too, race to use-after-free and
double-free vuln occur.
To prevent this, if device is registered from probe(), it should be
modified to free memory only through release() rather than calling
kfree() directly.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 87b9685cca91ed715c39ba544715832d26a7f4b4 | 87b9685cca91ed715c39ba544715832d26a7f4b4 |
| linux | linux | >= 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 131ec9046e1c8af101aebdaec4e8095e05f3312b | 131ec9046e1c8af101aebdaec4e8095e05f3312b |
| linux | linux | >= 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 67fd62e3efdc9dce01f76d95a745212f4feb38e6 | 67fd62e3efdc9dce01f76d95a745212f4feb38e6 |
| linux | linux | >= 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 45cbaf5c7cdc5386d86377f0daf94a17a007fed0 | 45cbaf5c7cdc5386d86377f0daf94a17a007fed0 |
| linux | linux | >= 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 98a0a81ce78020c2522e0046f49d200de9778cb9 | 98a0a81ce78020c2522e0046f49d200de9778cb9 |
| linux | linux | >= 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 07e9e674b6146b1f6fc41b1f54b8968bf2802824 | 07e9e674b6146b1f6fc41b1f54b8968bf2802824 |
| linux | linux | >= 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 2145c71a8044362e82e9923f001ba2aeb771b848 | 2145c71a8044362e82e9923f001ba2aeb771b848 |
| linux | linux | >= 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < fcd1d70792a35c8a97414fe429f48311e41269c2 | fcd1d70792a35c8a97414fe429f48311e41269c2 |
| linux | linux | >= 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 3b7da2b4d0fe014eff181ed37e3bf832eb8ed258 | 3b7da2b4d0fe014eff181ed37e3bf832eb8ed258 |
| linux | linux_kernel | < 6.6.136 | 6.6.136 |
| linux | linux_kernel | >= 6.13 < 6.18.24 | 6.18.24 |
| linux | linux_kernel | >= 6.19 < 6.19.14 | 6.19.14 |
| linux | linux_kernel | >= 6.7 < 6.12.83 | 6.12.83 |
| linux | linux_kernel | >= 7.0 < 7.0.1 | 7.0.1 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-nvidia | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
| ubuntu | linux-realtime | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 2.0
CVE-2026-46009 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drive
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 2.0
CVE-2026-46316 [LOW] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01·CVSS 2.0
CVE-2026-46042 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drivers;
- HID
Red Hat
kernel: media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
vendor_redhat·2026-04-24
CVE-2026-31576 CWE-364 kernel: media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
kernel: media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
A flaw was found in the Linux kernel's hackrf driver. A race condition exists where memory for the hackrf device is freed prematurely during device unregistration, even when file descriptors are still in use. This allows a local user to trigger a use-after-free and double-free vulnerability. Successful exploitation can lead to system instability, crashes, or a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: ker
VulDB
Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 Hackrf Driver hackrf_probe use after free (Nessus ID 310278 / WID-SEC-2026-1279)
vuldb·2026-05-26·CVSS 7.8
CVE-2026-31576 [HIGH] Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 Hackrf Driver hackrf_probe use after free (Nessus ID 310278 / WID-SEC-2026-1279)
A vulnerability has been found in Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 and classified as critical. Affected by this vulnerability is the function hackrf_probe of the component Hackrf Driver. This manipulation causes use after free.
This vulnerability is registered as CVE-2026-31576. The attack requires access to the local network. No exploit is available.
The affected component should be upgraded.
GHSA
GHSA-9h3v-wrpm-q7m5: In the Linux kernel, the following vulnerability has been resolved:
media: hackrf: fix to not free memory after the device is registered in hackrf_pr
ghsa_unreviewed·2026-04-24
CVE-2026-31576 GHSA-9h3v-wrpm-q7m5: In the Linux kernel, the following vulnerability has been resolved:
media: hackrf: fix to not free memory after the device is registered in hackrf_pr
In the Linux kernel, the following vulnerability has been resolved:
media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
In hackrf driver, the following race condition occurs:
```
CPU0 CPU1
hackrf_probe()
kzalloc(); // alloc hackrf_dev
....
v4l2_device_register();
....
fd = sys_open("/path/to/dev"); // open hackrf fd
....
v4l2_device_unregister();
....
kfree(); // free hackrf_dev
....
sys_ioctl(fd, ...);
v4l2_ioctl();
video_is_registered() // UAF!!
....
sys_close(fd);
v4l2_release() // UAF!!
hackrf_video_release()
kfree(); // DFB!!
```
When a V4L2 or video device is unregistered, the device node is removed so
new open() calls are blocked.
However, file descriptors that are already open-and any in-flight I/O-do
not terminate immediately; they remain val
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312bhttps://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2
2026-04-24
Published