CVE-2026-31578: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31578 is a race condition vulnerability in the Linux kernel's media: as102 USB driver that leads to use-after-free (UAF) and double-free (DFB) memory corruption. The flaw exists in the as102_usb_probe() function, where memory allocated for the as102_dev_t structure can be freed while open file descriptors still reference it. Affected Linux kernel versions include those before 6.6.136, 6.7–6.12.x before 6.12.83, 6.13–6.18.x before 6.18.24, 6.19.x before 6.19.14, and 7.0.x before 7.0.1. The vulnerability was published on April 24, 2026, with patches available shortly after. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-364) combined with use-after-free (CWE-416) in the as102_usb_probe() error path. When usb_register_dev() succeeds and a userspace process opens the device file descriptor before usb_deregister_dev() is called, the driver immediately frees the as102_dev_t structure via kfree(). When the userspace process later closes its file descriptor, as102_release() → as102_usb_release() is invoked, accessing or freeing the already-freed memory — resulting in UAF and double-free conditions. The attack vector is local, requires only low privileges, and no user interaction, making it exploitable by any user with access to the as102 USB device node (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation can result in kernel memory corruption, kernel panic (denial of service), or potential privilege escalation to root. The vulnerability affects confidentiality, integrity, and availability of the system, as kernel-level memory corruption can expose sensitive kernel data, allow arbitrary code execution in kernel context, or crash the system entirely. The scope is limited to the local system, but privilege escalation could enable lateral movement within a compromised environment (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability has an EPSS score of approximately 0.018% (0.000180), indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to open the as102 USB device file while racing the device deregistration process, which limits the practical attack surface (Red Hat Advisory).

1. Gain local access: Obtain a low-privileged local account on a system with an as102 USB DVB-T device attached and the as102 kernel module loaded.
2. Identify the device node: Locate the as102 USB character device node (e.g., /dev/swradio0 or similar) created by usb_register_dev().
3. Open the device file descriptor: Race to call sys_open() on the device node immediately after usb_register_dev() succeeds but before usb_deregister_dev() is called during an error path in as102_usb_probe().
4. Trigger deregistration: Cause or wait for the error path in as102_usb_probe() to execute usb_deregister_dev() followed by kfree(as102_dev_t), freeing the device structure while the file descriptor remains open.
5. Trigger UAF/double-free: Close the previously opened file descriptor, causing as102_release() → as102_usb_release() to access or free the already-freed as102_dev_t memory, resulting in kernel memory corruption.
6. Achieve impact: Leverage the kernel memory corruption to cause a kernel panic (DoS) or, with additional exploitation primitives, escalate privileges to root (Red Hat Bugzilla).

• Logs: Kernel oops or BUG messages in /var/log/kern.log or dmesg referencing as102_release, as102_usb_release, or memory corruption in the media/usb/as102 driver path.
• Logs: Kernel panic traces or KASAN (Kernel Address Sanitizer) reports indicating use-after-free or double-free in as102_usb_probe() or as102_usb_release().
• Process: Unexpected privilege escalation events from low-privileged users on systems with as102 USB devices attached.
• File System: Presence of as102 USB device nodes (e.g., created by usb_register_dev()) on systems where exploitation is suspected; check udevadm monitor for rapid device registration/deregistration events.

Upgrade the Linux kernel to a patched version: 6.6.136 or later, 6.12.83 or later (for 6.7–6.12.x), 6.18.24 or later (for 6.13–6.18.x), 6.19.14 or later (for 6.19.x), or 7.0.1 or later (for 7.0.x). The fix defers kfree(as102_dev_t) to the .release() callback, ensuring memory is not freed until all open file descriptors are closed. As a workaround, restrict access to as102 USB device nodes to trusted users only (e.g., via udev rules or file permissions), and avoid exposing systems with as102 USB devices to untrusted local users (Red Hat Advisory, Red Hat Bugzilla).