Loading story…
A race condition in the Linux kernel USB character-device driver layer, tracked as CVE-2019-19537, could be triggered by a malicious USB device. The flaw resides in drivers/usb/core/file.c and affects Linux kernel versions prior to 5.2.10.
The issue is associated with commit/CID 303911cfc5b9 and was remediated in Linux kernel 5.2.10. Organizations should deploy kernel versions containing this fix and restrict or monitor untrusted USB-device access on systems that cannot be promptly updated.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2019-19537 was updated.
MITRE published CVE-2019-19537 for the Linux kernel USB character-device driver race condition affecting versions before 5.2.10.
Linux kernel 5.2.10 included commit 303911cfc5b95d33687d9046133ff184cf5043ff, addressing a race condition in drivers/usb/core/file.c that could be triggered by a malicious USB device.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcegit.kernel.org
Open sourcecdn.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A use-after-free vulnerability, tracked as **CVE-2019-19530**, affected the Linux kernel's USB CDC-ACM driver in `drivers/usb/class/cdc-acm.c`. A malicious USB device could trigger the flaw on Linux kernel versions before **5.2.10**, potentially compromising the affected system through unsafe handling of the USB control-interface object's lifetime. The upstream fix, commit `c52873e5a1ef72f845526d9f6a50704433f9c625`, acquires the USB control-interface reference before CDC-ACM minor-number allocation and removes a later duplicate reference acquisition. The driver's destructor releases the retained reference, correcting cleanup behavior during failed allocation and normal device registration; Debian and openSUSE also issued advisories for affected packages.
Aug 28, 2026
Multiple Linux kernel HID and force-feedback drivers contained out-of-bounds write vulnerabilities tracked as **CVE-2019-19532**. A malicious USB HID device could trigger the flaws on kernels earlier than `5.3.9`, affecting drivers for force-feedback hardware from vendors including Logitech, Microsoft, Sony, and Holtek. The upstream fix in commit `d9d4b1e46d95` validates that a HID device has input entries before drivers access the first `hid_input` structure. Drivers now log “no inputs found” and return `-ENODEV` for malformed devices, preventing invalid list access that could cause kernel crashes or denial of service. Organizations using affected Linux kernels should deploy kernel `5.3.9` or applicable vendor security updates from Ubuntu, Debian, or openSUSE.
Aug 28, 2026
**CVE-2021-47582** affects the Linux kernel USB core's `USBDEVFS_CONTROL` and `USBDEVFS_BULK` ioctl paths in `drivers/usb/core/devio.c`. A local low-privileged user can issue requests with an excessively large timeout to an unresponsive USB device, leaving kernel tasks in uninterruptible waits long enough to trigger hung-task warnings and cause a denial-of-service condition. Red Hat rates the flaw as Low severity with a CVSS v3.1 score of 3.3. The upstream fix replaces the affected `usb_control_msg()` and `usb_bulk_msg()` usage with purpose-built logic using killable waits and `GFP_KERNEL` allocation, making `do_proc_control()` and `do_proc_bulk()` interruptible. The issue was fixed upstream in Linux 5.15.11 and 5.16; Red Hat shipped corrected RHEL 8 kernel and kernel-rt packages through RHSA-2024:7000 and RHSA-2024:7001, while fixes for RHEL 9 were deferred.
Aug 26, 2026