Loading story…
CVE-2019-19533 is an information-disclosure vulnerability in the Linux kernel's ttusb-dec USB media driver. A malicious USB device could trigger ttusb_dec_send_command() to transmit uninitialized kernel memory because the driver allocated its command buffer with kmalloc() and did not initialize every byte before passing it to usb_bulk_msg().
The affected code is in drivers/media/usb/ttusb-dec/ttusb_dec.c and impacts Linux kernels before version 5.3.4. Upstream commit a10feaf8c464 remediates the issue by replacing kmalloc() with zero-initializing kzalloc(), preventing residual kernel-memory contents from being sent to the connected USB device.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2019-19533 was published for an information-disclosure vulnerability in the Linux ttusb-dec USB media driver affecting kernel versions before 5.3.4. A malicious USB device could trigger disclosure of residual kernel memory.
Tomas Bortoli authored a patch replacing kmalloc() with zero-initializing kzalloc() in ttusb_dec_send_command(), preventing uninitialized kernel memory from being sent to a USB device. The issue had been reported by syzbot.
Mauro Carvalho Chehab committed the fix as a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1, addressing uninitialized command-buffer bytes in the TTUSB-DEC media driver.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-45887** is a memory-leak flaw in the Linux kernel's TTUSB-DEC USB media driver, caused by `ttusb_dec_exit_dvb()` unregistering a DVB frontend without calling `dvb_frontend_detach()`. A local low-privileged user who can repeatedly connect and disconnect an affected device could exhaust kernel memory and cause a denial of service. The issue affects kernel versions through 6.0.9 and is classified as CWE-401; Red Hat rates it Moderate with a CVSS v3.1 score of 4.7. Upstream corrected the cleanup path in commit `517a28133832` by using `dvb_frontend_detach(dec->fe)`, allowing the frontend to be freed properly; Fedora received the fix in stable kernel 6.3.7. Red Hat issued fixes for affected RHEL 8 kernel variants, including 8.6 and 8.8 Extended Update Support, and relevant Red Hat Virtualization 4 deployments; RHEL 9 is unaffected. Organizations unable to patch can reduce exposure by blacklisting the `ttusb_dec` kernel module.
Aug 26, 2026
A race condition in the Linux kernel USB character-device driver layer, tracked as **CVE-2019-19537**, could be triggered by a malicious USB device. The flaw resides in `drivers/usb/core/file.c` and affects Linux kernel versions prior to 5.2.10. The issue is associated with commit/CID `303911cfc5b9` and was remediated in Linux kernel **5.2.10**. Organizations should deploy kernel versions containing this fix and restrict or monitor untrusted USB-device access on systems that cannot be promptly updated.
Aug 28, 2026
A use-after-free vulnerability, tracked as **CVE-2019-19530**, affected the Linux kernel's USB CDC-ACM driver in `drivers/usb/class/cdc-acm.c`. A malicious USB device could trigger the flaw on Linux kernel versions before **5.2.10**, potentially compromising the affected system through unsafe handling of the USB control-interface object's lifetime. The upstream fix, commit `c52873e5a1ef72f845526d9f6a50704433f9c625`, acquires the USB control-interface reference before CDC-ACM minor-number allocation and removes a later duplicate reference acquisition. The driver's destructor releases the retained reference, correcting cleanup behavior during failed allocation and normal device registration; Debian and openSUSE also issued advisories for affected packages.
Aug 28, 2026