Loading story…
CVE-2022-45886 is a Linux kernel use-after-free flaw in the DVB core networking component, drivers/media/dvb-core/dvb_net.c. A time-of-check/time-of-use race between DVB device disconnection and dvb_device_open() can let a low-privileged local attacker crash a vulnerable system or potentially elevate privileges. Exploitation requires access to DVB hardware—either physical access or an authenticated remote user able to predict the hardware's disconnect/reconnect timing.
The issue affects kernels through version 6.0.9 and was fixed upstream by serializing open, close, release, and removal operations with a remove_mutex; opens during device removal are rejected with -ENODEV. Red Hat rated the flaw Moderate with CVSS 7.0 and issued fixes for affected RHEL 8 kernel variants through November 2023; RHEL 9 and RHEL 9 real-time kernels are not affected. Organizations unable to patch can mitigate exposure by blacklisting the dvb-core kernel module.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:7548 and RHSA-2023:7549 for affected RHEL 8 kernel-rt and kernel packages, respectively, and RHSA-2023:7539 for RHEL 8.8 Extended Update Support. These errata addressed the DVB-core race-condition use-after-free vulnerability.
Red Hat released RHSA-2023:7398 to address CVE-2022-45886 for the RHEL 8.6 Extended Update Support kernel. The advisory also provided a fixed kernel for Red Hat Virtualization 4 on RHEL 8.
Guilherme de Almeida Suckevicz reported the Linux kernel DVB networking use-after-free issue, later designated CVE-2022-45886. The flaw stems from a race between device disconnection and dvb_device_open().
Hyunwoo Kim submitted a patch in a four-patch series to fix use-after-free conditions in the DVB core's dvb_net component. The proposed change added remove_mutex locking and rejected device opens with -ENODEV while removal was in progress.
Fedora addressed CVE-2022-45886 in its stable kernel version 6.3.7.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-41218** is a medium-severity use-after-free flaw in the Linux kernel's `dvb-core` subsystem, affecting Digital Video Broadcasting devices. A local low-privileged attacker could race malicious code against removal of a USB DVB demultiplexer or similar device, causing freed memory in `drivers/media/dvb-core/dmxdev.c` to be accessed. Successful exploitation could crash the host or potentially elevate privileges, although Red Hat rated the issue CVSS 5.5 because physical device removal and a difficult-to-win race condition are required. Kernel developers identified related DVB frontend, network, and device-registration races involving concurrent open, close, and USB-disconnect operations; KASAN reproduced the use-after-free conditions on Linux 6.1.0-rc2 and later. Fedora shipped a fix in kernel 6.0.18 stable updates, while Red Hat remediated affected RHEL 8 `kernel` and `kernel-rt` packages through RHSA-2023:2736 and RHSA-2023:2951, with subsequent coverage for RHEL 8.6 EUS and Red Hat Virtualization 4. Organizations unable to patch can mitigate exposure by preventing the `dvb-core` module from loading; RHEL 9 `kernel-rt` was marked will not fix.
Aug 26, 2026
**CVE-2023-28328** affects the Linux kernel's AZ6027 USB DVB media-driver I2C transfer routine, `az6027_i2c_xfer()`. A local low-privileged user can submit a crafted I2C message—such as address `0x99` with zero length and a NULL buffer—causing the driver to dereference `msg[i].buf[0]` and crash the kernel. The defect was found through kernel fuzzing, which reproduced a KASAN-detected general-protection fault through the `I2C_RDWR` ioctl path. The upstream fix validates that the I2C message length is at least one before accessing its buffer and returns `-EOPNOTSUPP` for invalid requests. Red Hat rated the issue Moderate with CVSS 3.1 score 5.5, released fixes for affected RHEL 8 kernel streams, and stated that RHEL 9 is unaffected. Until patched, administrators can reduce exposure by blacklisting the `dvb_usb_az6027` kernel module where the associated hardware is not required.
Aug 26, 2026
**CVE-2022-45887** is a memory-leak flaw in the Linux kernel's TTUSB-DEC USB media driver, caused by `ttusb_dec_exit_dvb()` unregistering a DVB frontend without calling `dvb_frontend_detach()`. A local low-privileged user who can repeatedly connect and disconnect an affected device could exhaust kernel memory and cause a denial of service. The issue affects kernel versions through 6.0.9 and is classified as CWE-401; Red Hat rates it Moderate with a CVSS v3.1 score of 4.7. Upstream corrected the cleanup path in commit `517a28133832` by using `dvb_frontend_detach(dec->fe)`, allowing the frontend to be freed properly; Fedora received the fix in stable kernel 6.3.7. Red Hat issued fixes for affected RHEL 8 kernel variants, including 8.6 and 8.8 Extended Update Support, and relevant Red Hat Virtualization 4 deployments; RHEL 9 is unaffected. Organizations unable to patch can reduce exposure by blacklisting the `ttusb_dec` kernel module.
Aug 26, 2026