Executive brief
The Linux kernel's usbtv driver, which provides audio/video capture for USB TV devices, contains a use-after-free vulnerability in its audio subsystem. When a USB device is disconnected while an audio file remains open, the kernel can free the device data structure before the audio system finishes closing the file, causing a crash or potential code execution when the audio file is subsequently closed.
Technical details
The vulnerability is a use-after-free (CWE-416) in the usbtv driver's audio handling code. The root cause is a reference counting mismatch: ALSA PCM callbacks store driver state in pcm->private_data, and the disconnect handler calls usbtv_audio_free() which uses snd_card_free_when_closed() to defer card cleanup. However, the disconnect path can drop the V4L2 device reference and free struct usbtv before ALSA releases the substream, causing snd_usbtv_pcm_close() to dereference freed memory on subsequent close. The fix adds explicit V4L2 device reference counting: a reference is acquired when the ALSA card is initialized and released in a private_free callback, ensuring struct usbtv remains valid until all ALSA files are closed. Attack vector is local; exploitation requires the attacker to have a USB device connected and be able to trigger disconnection while audio files are open.
Affected products
- Linux Linux kernel multiple versions with usbtv audio support (patches available for stable branches 4.19 through 7.2+)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-09-11: patched: Patch committed to stable kernel branches
- 2026-07-06: other: Original commit authored by Shuangpeng Bai