Skip to main content

Linux Kernel EUVDEUVD-2026-25475

| CVE-2026-31582 HIGH
Use After Free (CWE-416)
2026-04-24 Linux GHSA-7v66-mw99-f72x
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local sysfs read needs low privilege (PR:L) and a timing-sensitive disconnect race (AC:H); kernel UAF can yield memory corruption affecting C/I/A, hence high impacts.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:02 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
7.8 (HIGH)
Patch released
Apr 27, 2026 - 20:26 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25475
CVE Published
Apr 24, 2026 - 14:42 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (powerz) Fix use-after-free on USB disconnect

After powerz_disconnect() frees the URB and releases the mutex, a subsequent powerz_read() call can acquire the mutex and call powerz_read_data(), which dereferences the freed URB pointer.

Fix by:

  • Setting priv->urb to NULL in powerz_disconnect() so that

powerz_read_data() can detect the disconnected state.

  • Adding a !priv->urb check at the start of powerz_read_data()

to return -ENODEV on a disconnected device.

  • Moving usb_set_intfdata() before hwmon registration so the

disconnect handler can always find the priv pointer.

AnalysisAI

Local privilege-relevant memory corruption in the Linux kernel's powerz hwmon driver (ChargerLAB POWER-Z USB power monitor) allows a local user to trigger a use-after-free by racing a sysfs read against USB device disconnect, dereferencing a freed URB pointer. The bug affects kernels prior to the stable fixes (7.0.1, 6.19.14, 6.18.24, 6.12.83) and carries CVSS 7.8, but with EPSS at just 0.02% (5th percentile) and no public exploit identified at time of analysis, real-world exploitation risk is low. It is not listed in CISA KEV.

Technical ContextAI

The affected component is the powerz hwmon driver (drivers/hwmon/powerz.c), a Linux kernel module that exposes voltage/current telemetry from ChargerLAB POWER-Z USB meters through the hwmon sysfs interface. The root cause is CWE-416 (Use-After-Free): powerz_disconnect() frees the USB Request Block (URB) and releases the driver mutex, but a concurrent powerz_read() can then re-acquire the mutex and call powerz_read_data(), which dereferences the now-freed priv->urb pointer. The fix sets priv->urb to NULL on disconnect, adds a !priv->urb guard returning -ENODEV, and moves usb_set_intfdata() before hwmon registration so the disconnect handler can always resolve the priv pointer. The CPE data (cpe:2.3:a:linux:linux) identifies the Linux kernel as the affected product, though the vulnerable code path is confined to systems where this specific driver is loaded and a POWER-Z device is present.

RemediationAI

Vendor-released patch: update to Linux 7.0.1, 6.19.14, 6.18.24, or 6.12.83 (or later on each branch), applying the stable fix commits at https://git.kernel.org/stable/c/c78e1d4e48f23792adaa7c94251e22b0d9700a39 and the sibling backports. Distribution users should apply their vendor kernel update - for example Ubuntu USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1) and the equivalent Red Hat/SUSE errata - and reboot into the patched kernel. Where immediate patching is not possible, a targeted compensating control is to blacklist/unload the powerz module (e.g. add 'blacklist powerz' to modprobe config) on systems that do not use ChargerLAB POWER-Z hardware, which removes the vulnerable code path entirely with no functional loss on unaffected systems; the trade-off is loss of POWER-Z telemetry where that device is legitimately used. Restricting physical USB port access and limiting local accounts that can rapidly poll hwmon sysfs further reduces the race window.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25475 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy