media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.13 % · centile 2 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: media: hackrf: fix to not free memory after the device is registered in hackrf_probe() In hackrf driver, the following race condition occurs: ``` CPU0 CPU1 hackrf_probe() kzalloc(); // alloc hackrf_dev .... v4l2_device_register(); .... fd = sys_open("/path/to/dev"); // open hackrf fd .... v4l2_device_unregister(); .... kfree(); // free hackrf_dev .... sys_ioctl(fd, ...); v4l2_ioctl(); video_is_registered() // UAF!! .... sys_close(fd); v4l2_release() // UAF!! hackrf_video_release() kfree(); // DFB!! ``` When a V4L2 or video device is unregistered, the device node is removed so new open() calls are blocked. However, file descriptors that are already open-and any in-flight I/O-do not terminate immediately; they remain valid until the last reference is dropped and the driver's release() is invoked. Therefore, freeing device memory on the error path after hackrf_probe() has registered dev it will lead to a race to use-after-free vuln, since those already-open handles haven't been released yet. And since release() free memory too, race to use-after-free and double-free vuln occur. To prevent this, if device is registered from probe(), it should be modified to free memory only through release() rather than calling kfree() directly.
Faiblesses (CWE)
- CWE-416 — Utilisation après libération
Références
- https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4
- https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b
- https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6
- https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0
- https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9
- https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824
- https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848
- https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2
- https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-25469
- GCVE · GCVE-0-2026-31576
Avis du CERT-FR
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1093 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0985 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0862 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0861 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0831 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0548 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 6.6.136cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.83cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.24cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.14cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 7.0 < 7.0.1
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 87b9685cca91ed715c39ba544715832d26a7f4b4 ; affected 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 131ec9046e1c8af101aebdaec4e8095e05f3312b ; affected 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 67fd62e3efdc9dce01f76d95a745212f4feb38e6 ; affected 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 45cbaf5c7cdc5386d86377f0daf94a17a007fed0 ; affected 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 98a0a81ce78020c2522e0046f49d200de9778cb9 ; affected 8bc4a9ed85046c214458c9e82aea75d2f46cfffd < 07e9e674b6146b1f6fc41b1f54b8968bf2802824 |
| Linux · Linux | affected 4.4 ; unaffected 0 < 4.4 ; unaffected 5.10.258 ≤ 5.10.* ; unaffected 5.15.209 ≤ 5.15.* ; unaffected 6.1.175 ≤ 6.1.* ; unaffected 6.6.136 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |