Executive brief
The airspy media driver in the Linux kernel contains a NULL pointer dereference vulnerability that can occur when a user closes a streaming device after it has been physically disconnected. This can cause the kernel to crash or become unstable, disrupting operations for any system using this driver with airspy hardware.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) in the airspy driver's disconnect and stop_streaming paths. When airspy_disconnect() is called, it clears s->udev under v4l2_lock, but if a user then closes the device while streaming, airspy_stop_streaming() unconditionally dereferences the now-NULL s->udev in calls to airspy_ctrl_msg() and airspy_free_stream_bufs(). The fix replaces video_unregister_device() with vb2_video_unregister_device(), which synchronously stops streaming before udev is cleared, ensuring all hardware operations complete while s->udev remains valid. No patch or public exploit is known; this appears to be a proactive fix discovered through automated code review.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-09-16: disclosed