EUVD-2026-80640
GHSA-2r4w-xph6-45qv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local trigger requiring the physical usbtv device plus a disconnect-vs-close race (AC:H), local sound-device access (PR:L), crash-only impact with no leak (C:N/I:L/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: usbtv: keep device alive while ALSA card exists
The ALSA PCM callbacks store the driver state in pcm->private_data. An open PCM file can outlive USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can then drop the V4L2 device reference and free struct usbtv before ALSA releases the substream, so a later close dereferences freed memory in snd_usbtv_pcm_close().
Take a V4L2 device reference for the ALSA card and drop it from the card private_free callback. This keeps struct usbtv valid until ALSA has closed the remaining files and freed the card.
AnalysisAI
A use-after-free in the Linux kernel's usbtv media driver ALSA audio path can crash the kernel or trigger limited memory corruption when a Fushicai USBTV007 USB analog TV/audio capture device is physically disconnected while a local user still has the PCM substream open. The driver frees its per-device state (struct usbtv) during the disconnect path while ALSA still references it via pcm->private_data, so a later snd_usbtv_pcm_close() dereferences freed memory; the kernel fix takes an extra V4L2 device reference for the lifetime of the ALSA card and releases it in the card's private_free callback. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a physical Fushicai USBTV007 USB analog TV/audio capture device bound to the usbtv driver, a local user with access to the ALSA sound device to open the PCM substream, and a USB disconnect event (typically physical unplug or port/hub removal) occurring while a PCM file is still open. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a use-after-free (CWE-416) in the Linux kernel usbtv media driver's ALSA audio path, disclosed by the kernel team with a vendor CVSS of 7.8 (AV:L/AC:L/PR:L/C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to the maintenance release that contains the fix on your branch - 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 or 7.3-rc1 (or newer) - or cherry-pick the upstream commit identified by the git.kernel.org stable links (503be26ff888cb3576e55d251895d290e8146f27, 97b5e8b22b98e287481a97a9a4cfebbb348738a5, be0f7745f883386e5263b4e475686a81dfa87175, 67374e3a00814dcdd46e9feca61f69f7f2d81957, 239d1683e08b2aee2a15ef35706e1ea9a76681d8, 7690a86b193271322cd31ab77349a87aa10858e4, 1618257cb0aba4ce342ae8c0228368c24161f5fb, fc530fe168bb2b745a93f553ad21fc25fd9cba3d) onto an unpatched kernel tree; patched kernels require a reboot to load the new usbtv module. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether any managed endpoints, lab machines, kiosks, or media-capture workstations have a Fushicai USBTV007 (usbtv) device attached or the usbtv kernel module loaded, and where they do, suspend use of the device or unload/blacklist the usbtv module until the kernel is updated; where the device is not needed, the module can be blacklisted permanently as a low-cost hardening step. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today