Executive brief
A vulnerability was identified in the Linux kernel's HackRF driver, which supports popular software-defined radio hardware. A flaw in how the system handles device memory during initialization could allow a local attacker to cause a system crash or potentially execute unauthorized code. This occurs because the system may try to use or free memory that has already been released when a device is disconnected or fails to start correctly.
Technical details
A race condition exists in the HackRF driver (drivers/media/usb/hackrf/hackrf.c) within the hackrf_probe() function. When a device is registered via v4l2_device_register(), a local user can open the device file descriptor. If the probe subsequently fails or the device is unregistered, the driver incorrectly calls kfree() on the device structure while the file descriptor is still open. This leads to a Use-After-Free (UAF) when the user performs IOCTL operations and a Double-Free (DFB) when the file descriptor is finally closed and the driver's release() function is triggered. The fix involves using v4l2_device_put() to ensure memory is only freed when the final reference is dropped.
Affected products
- Linux Linux Kernel up to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-01-10: other: Vulnerability reported by syzbot
- 2026-04-22: patched: Fix committed to stable kernel trees
- 2026-04-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824
- https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b
- https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848
- https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258
- https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0
- https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6
- https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4