Loading story…
CVE-2022-41218 is a medium-severity use-after-free flaw in the Linux kernel's dvb-core subsystem, affecting Digital Video Broadcasting devices. A local low-privileged attacker could race malicious code against removal of a USB DVB demultiplexer or similar device, causing freed memory in drivers/media/dvb-core/dmxdev.c to be accessed. Successful exploitation could crash the host or potentially elevate privileges, although Red Hat rated the issue CVSS 5.5 because physical device removal and a difficult-to-win race condition are required.
Kernel developers identified related DVB frontend, network, and device-registration races involving concurrent open, close, and USB-disconnect operations; KASAN reproduced the use-after-free conditions on Linux 6.1.0-rc2 and later. Fedora shipped a fix in kernel 6.0.18 stable updates, while Red Hat remediated affected RHEL 8 kernel and kernel-rt packages through RHSA-2023:2736 and RHSA-2023:2951, with subsequent coverage for RHEL 8.6 EUS and Red Hat Virtualization 4. Organizations unable to patch can mitigate exposure by preventing the dvb-core module from loading; RHEL 9 kernel-rt was marked will not fix.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat fixed affected RHEL 8 kernel-rt packages through RHSA-2023:2736 and RHEL 8 kernel packages through RHSA-2023:2951. Red Hat also closed its tracking bug for the vulnerability.
Hyunwoo Kim submitted a four-patch Linux kernel series to fix multiple race-condition use-after-free issues in DVB core components and a memory leak in the ttusb-dec USB driver. The author said most patches resembled an earlier security patch for CVE-2022-41218.
CVE-2022-41218 was published as a moderate use-after-free vulnerability in the Linux kernel dvb-core subsystem, with potential for system crashes or local privilege escalation.
A patch addressing the issue was referenced in a Linux kernel mailing-list post.
A use-after-free race condition affecting the Linux kernel's DVB core demultiplexer handling was reported. Exploitation requires local malicious code execution alongside physical removal of a USB DVB device.
RHSA-2024:0412 fixed the vulnerability for the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 on RHEL 8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-45886** is a Linux kernel use-after-free flaw in the DVB core networking component, `drivers/media/dvb-core/dvb_net.c`. A time-of-check/time-of-use race between DVB device disconnection and `dvb_device_open()` can let a low-privileged local attacker crash a vulnerable system or potentially elevate privileges. Exploitation requires access to DVB hardware—either physical access or an authenticated remote user able to predict the hardware's disconnect/reconnect timing. The issue affects kernels through version 6.0.9 and was fixed upstream by serializing open, close, release, and removal operations with a `remove_mutex`; opens during device removal are rejected with `-ENODEV`. Red Hat rated the flaw Moderate with CVSS 7.0 and issued fixes for affected RHEL 8 kernel variants through November 2023; RHEL 9 and RHEL 9 real-time kernels are not affected. Organizations unable to patch can mitigate exposure by blacklisting the `dvb-core` kernel module.
Aug 26, 2026
**CVE-2023-28328** affects the Linux kernel's AZ6027 USB DVB media-driver I2C transfer routine, `az6027_i2c_xfer()`. A local low-privileged user can submit a crafted I2C message—such as address `0x99` with zero length and a NULL buffer—causing the driver to dereference `msg[i].buf[0]` and crash the kernel. The defect was found through kernel fuzzing, which reproduced a KASAN-detected general-protection fault through the `I2C_RDWR` ioctl path. The upstream fix validates that the I2C message length is at least one before accessing its buffer and returns `-EOPNOTSUPP` for invalid requests. Red Hat rated the issue Moderate with CVSS 3.1 score 5.5, released fixes for affected RHEL 8 kernel streams, and stated that RHEL 9 is unaffected. Until patched, administrators can reduce exposure by blacklisting the `dvb_usb_az6027` kernel module where the associated hardware is not required.
Aug 26, 2026
**CVE-2022-45887** is a memory-leak flaw in the Linux kernel's TTUSB-DEC USB media driver, caused by `ttusb_dec_exit_dvb()` unregistering a DVB frontend without calling `dvb_frontend_detach()`. A local low-privileged user who can repeatedly connect and disconnect an affected device could exhaust kernel memory and cause a denial of service. The issue affects kernel versions through 6.0.9 and is classified as CWE-401; Red Hat rates it Moderate with a CVSS v3.1 score of 4.7. Upstream corrected the cleanup path in commit `517a28133832` by using `dvb_frontend_detach(dec->fe)`, allowing the frontend to be freed properly; Fedora received the fix in stable kernel 6.3.7. Red Hat issued fixes for affected RHEL 8 kernel variants, including 8.6 and 8.8 Extended Update Support, and relevant Red Hat Virtualization 4 deployments; RHEL 9 is unaffected. Organizations unable to patch can reduce exposure by blacklisting the `ttusb_dec` kernel module.
Aug 26, 2026