CVE-2026-31578
Description
A flaw was found in the Linux kernel's as102_usb driver. A local user could exploit a race condition during the handling of USB device registration and deregistration. This vulnerability occurs when a device's memory is prematurely freed while an open file descriptor still exists, leading to a use-after-free or double-free condition. Such memory corruption could potentially allow for privilege escalation or cause a denial of service.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Modify Memory; DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands
It may be possible to cause data corruption and possibly execute arbitrary code by modifying global variables or data structures at unexpected times, violating the assumptions of code that uses this global data.
Access Control
Technical Impact: Gain Privileges or Assume Identity
If a signal handler interrupts code that is executing with privileges, it may be possible that the signal handler will also be executed with elevated privileges, possibly making subsequent exploits more severe.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
