Executive brief
A vulnerability was identified in the Linux kernel's chaoskey driver, which manages Altus Metrum ChaosKey hardware. If a user closes the device file after the USB device has been physically unplugged, the system may attempt to access memory that has already been freed. This could lead to a system crash or instability, though it is primarily triggered during debugging scenarios.
Technical details
A slab-use-after-free vulnerability exists in drivers/usb/misc/chaoskey.c within the chaoskey_release() function. The root cause is a debugging statement (usb_dbg) that attempts to access the usb_interface structure after its final reference has been dropped by chaoskey_free(). This occurs specifically when a user closes the device file after the physical USB device has been disconnected. An attacker with physical access or a local user could potentially trigger a kernel oops or KASAN splat by unplugging the device and closing the associated file descriptor. The issue has been resolved by removing the problematic debugging statement across multiple stable kernel branches.
Affected products
- Linux Linux kernel 66e3e591891da9899a8990792da080432531ffd4
Timeline
- 2026-06-09: patched: Initial patch authored by Alan Stern
- 2026-07-25: advisory: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/2a52d55c86a429dac47886b8424e67f90b001e67
- https://git.kernel.org/stable/c/3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89
- https://git.kernel.org/stable/c/5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023
- https://git.kernel.org/stable/c/6c82f88bc7a8458d5c60f9b354c4d32d233f0cac
- https://git.kernel.org/stable/c/8f50613bff228272577893aa10a346a2f3063e49
- https://git.kernel.org/stable/c/abf76d3239dee97b66e7241ad04811f1ce562e28
- https://git.kernel.org/stable/c/f3e409476ad0703c54c14f245e4e143c8124e1bd