Executive brief
The em28xx driver (used for USB media capture devices) contains a memory safety bug in its device disconnection logic. When a dual-tuner device is unplugged, one internal device reference is not properly removed from the system's device list, leaving a dangling pointer that causes a kernel crash when the next device is connected. This can lead to denial of service through device unavailability.
Technical details
The vulnerability is a use-after-free in the em28xx media driver's disconnect path. When a device with has_dual_ts=1 takes the is_audio_only code path, both dev and dev->dev_next are added to the global em28xx_devlist. However, em28xx_close_extension() only removes dev->devlist, leaving dev->dev_next->devlist as a dangling pointer. When dev_next is freed via kref_put(), the next device probe triggers list corruption in list_add_tail when it detects the freed node. The vulnerability requires a malformed USB device descriptor (fuzzed endpoint addresses like 0xf3) that are normalized by recent USB core changes, making the previously unreachable is_audio_only + has_dual_ts code path executable. The fix adds an explicit list_del() call for dev->dev_next->devlist before device teardown.
Affected products
- Linux Linux kernel multiple versions (fix applied across linux-3.x through linux-7.x stable branches)
Timeline
- 2026-09-16: disclosed: CVE published
- 2026-09-11: patched: Fix committed to stable branches
- 2026-06-30: other: Fix authored by Jiangong.Han