CVE-2026-31578

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: as102: fix to not free memory after the device is registered in as102_usb_probe()

In as102_usb driver, the following race condition occurs:

```

CPU0 CPU1

as102_usb_probe()

kzalloc(); // alloc as102_dev_t

....

usb_register_dev();

fd = sys_open("/path/to/dev"); // open as102 fd

....

usb_deregister_dev();

....

kfree(); // free as102_dev_t

....

sys_close(fd);

as102_release() // UAF!!

as102_usb_release()

kfree(); // DFB!!

```

When a USB character device registered with usb_register_dev() is later

unregistered (via usb_deregister_dev() or disconnect), the device node is

removed so new open() calls fail. However, file descriptors that are

already open do not go away immediately: they remain valid until the last

reference is dropped and the driver's .release() is invoked.

In as102, as102_usb_probe() calls usb_register_dev() and then, on an

error pa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References