Skip to main content

Linux Kernel EUVDEUVD-2026-25476

| CVE-2026-31583 HIGH
Use After Free (CWE-416)
2026-04-24 Linux GHSA-2hvg-8mmr-f5mc
Denial Of Service Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local V4L2 device access by a low-priv user (AV:L/PR:L); AC:H because it is a timing-dependent race against init-error/teardown paths; UAF enables full CIA impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:00 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
7.8 (HIGH)
Patch released
Apr 27, 2026 - 20:26 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25476
CVE Published
Apr 24, 2026 - 14:42 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: em28xx: fix use-after-free in em28xx_v4l2_open()

em28xx_v4l2_open() reads dev->v4l2 without holding dev->lock, creating a race with em28xx_v4l2_init()'s error path and em28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct and set dev->v4l2 to NULL under dev->lock.

This race leads to two issues:

  • use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler,

since the video_device is embedded in the freed em28xx_v4l2 struct.

  • NULL pointer dereference in em28xx_resolution_set() when accessing

v4l2->norm, since dev->v4l2 has been set to NULL.

Fix this by moving the mutex_lock() before the dev->v4l2 read and adding a NULL check for dev->v4l2 under the lock.

AnalysisAI

Local privilege escalation and denial of service in the Linux kernel's em28xx USB media driver arises from a use-after-free (CWE-416) in em28xx_v4l2_open(), which reads dev->v4l2 without holding dev->lock. A local attacker who can open the V4L2 device node during a race with the driver's init error path or teardown can trigger a use-after-free on the embedded video_device (via v4l2_fh_init accessing vdev->ctrl_handler) or a NULL dereference in em28xx_resolution_set(). No public exploit identified at time of analysis, and EPSS is very low (0.02%), consistent with a hard-to-win kernel race requiring physical/local USB device presence.

Technical ContextAI

The affected component is the em28xx driver, part of the Linux kernel's Video4Linux2 (V4L2) media subsystem, which supports Empia em28xx-based USB video/TV capture devices. The em28xx_v4l2 structure embeds the video_device object and holds V4L2 state such as the current TV norm (v4l2->norm). Access to dev->v4l2 is meant to be serialized by dev->lock: em28xx_v4l2_init()'s error path and em28xx_v4l2_fini() both free the struct and set dev->v4l2 = NULL under that lock. The root cause is CWE-416 (Use After Free): em28xx_v4l2_open() read dev->v4l2 outside the lock, so a concurrent free left it dereferencing freed memory (video_device/ctrl_handler) or a NULL pointer (norm). The fix moves mutex_lock() before the dev->v4l2 read and adds a NULL check under the lock.

RemediationAI

Update to a fixed stable kernel: Vendor-released patch: 6.12.83, 6.18.24, 6.19.14, or 7.0.1 (whichever matches your branch), via the kernel.org stable commits (e.g. https://git.kernel.org/stable/c/dd2b888e08d3b3d6aacd65d76cd44fac11da750f and https://git.kernel.org/stable/c/5fb2940327722b4684d2f964b54c1c90aa277324). Distro users should apply their vendor kernel update - for Ubuntu, follow USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1) and reboot. Where immediate patching is not possible, a practical compensating control is to prevent the vulnerable driver from loading if the hardware is not needed: blacklist the em28xx modules (e.g. add 'blacklist em28xx' and related em28xx_* to modprobe.d) - trade-off is loss of support for Empia-based USB capture/TV devices. Restricting physical USB access and limiting which local users can open /dev/video* nodes (udev permissions/ACLs) also reduces the local attack surface, at the cost of tightening device access for legitimate media users.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25476 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy