Loading story…
Ubuntu released kernel and Hardware Enablement (HWE) updates for Ubuntu 18.04 LTS, including Azure kernel packages, to remediate CVE-2019-19524 and numerous other kernel vulnerabilities. CVE-2019-19524 affects the force-feedback memless input driver in drivers/input/ff-memless.c before Linux kernel 5.3.12; a malicious USB device could trigger a use-after-free condition, potentially causing denial of service or code execution.
The upstream fix, commit fa3a5a1880c91bb92594ad42dfe9eedad7996b86, synchronously deletes the driver's ml->timer during device destruction so it cannot remain active after the input device is removed. Ubuntu's related advisories also address flaws in SMB/CIFS, wireless, USB, network, Binder IPC, tracing, and other drivers, with impacts including kernel-memory disclosure, crashes, arbitrary-file overwrite, and potential arbitrary code execution; affected systems should install the applicable standard, HWE, or Azure kernel updates.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2019-19524 was updated, retaining references to the upstream fix and downstream distribution advisories.
CVE-2019-19524 was published for a use-after-free vulnerability in Linux's drivers/input/ff-memless.c, affecting kernels before version 5.3.12. A malicious USB device can trigger the flaw, potentially causing a crash or arbitrary code execution.
Oliver Neukum authored Linux commit fa3a5a1880c91bb92594ad42dfe9eedad7996b86, adding del_timer_sync() to ml_ff_destroy() so the memless driver timer is stopped before its private state is freed. Dmitry Torokhov committed the patch, which was marked for stable-kernel consideration.
Ubuntu issued kernel updates through USN-4225, USN-4226, USN-4227, and USN-4228, including HWE and Azure-related updates, to address CVE-2019-19524 and other kernel flaws. openSUSE, Slackware, and Debian LTS also issued related security advisories.
syzbot reported and tested an issue in the Linux force-feedback memless input driver where an active timer could access freed state after device teardown.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
usn.ubuntu.com
Open sourceusn.ubuntu.com
Open sourceusn.ubuntu.com
Open sourcecve.mitre.org
Open sourceusn.ubuntu.com
Open sourceusn.ubuntu.com
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Linux kernel HID and force-feedback drivers contained out-of-bounds write vulnerabilities tracked as **CVE-2019-19532**. A malicious USB HID device could trigger the flaws on kernels earlier than `5.3.9`, affecting drivers for force-feedback hardware from vendors including Logitech, Microsoft, Sony, and Holtek. The upstream fix in commit `d9d4b1e46d95` validates that a HID device has input entries before drivers access the first `hid_input` structure. Drivers now log “no inputs found” and return `-ENODEV` for malformed devices, preventing invalid list access that could cause kernel crashes or denial of service. Organizations using affected Linux kernels should deploy kernel `5.3.9` or applicable vendor security updates from Ubuntu, Debian, or openSUSE.
Aug 28, 2026
Microsoft published a broad batch of Security Update Guide entries for Linux kernel flaws affecting memory management, networking, virtualization, device drivers, and subsystem input validation. The listed issues include use-after-free, NULL dereference, integer underflow, refcount underflow, information disclosure, and bounds-checking failures tracked as **`CVE-2026-31496`**, **`CVE-2026-31458`**, **`CVE-2026-31689`**, **`CVE-2026-31615`**, **`CVE-2026-31664`**, **`CVE-2026-31656`**, **`CVE-2026-31611`**, **`CVE-2026-31671`**, **`CVE-2026-31612`**, and others. Affected components span `nf_conntrack_expect`, `damon`, `edac_mc`, `renesas_usb3`, `xfrm`, `drm/i915`, `ksmbd`, `stmmac`, `tipc`, `mptcp`, `NFC`, `HID`, `KVM`, `mmc`, `x86/CPU`, `PCI endpoint`, `blk-cgroup`, `media/as102`, and `altera-tse`. Several entries point to bugs that could lead to kernel crashes, memory corruption, or data leakage if triggered through malformed input, protocol handling, or device interaction. Notable examples include a slab use-after-free in `mptcp`, information leaks in `xfrm_user` and `xfrm`, validation flaws in `ksmbd`, endpoint index handling in `usb: gadget: renesas_usb3`, and multiple underflow and teardown-ordering bugs across networking and driver code. The disclosures indicate a coordinated publication of upstream Linux kernel fixes through Microsoft's advisory channel, underscoring the need for organizations running Linux workloads in Microsoft-connected environments to review affected kernel versions and apply vendor patches promptly.
Jul 12, 2026
A use-after-free vulnerability, tracked as **CVE-2019-19530**, affected the Linux kernel's USB CDC-ACM driver in `drivers/usb/class/cdc-acm.c`. A malicious USB device could trigger the flaw on Linux kernel versions before **5.2.10**, potentially compromising the affected system through unsafe handling of the USB control-interface object's lifetime. The upstream fix, commit `c52873e5a1ef72f845526d9f6a50704433f9c625`, acquires the USB control-interface reference before CDC-ACM minor-number allocation and removes a later duplicate reference acquisition. The driver's destructor releases the retained reference, correcting cleanup behavior during failed allocation and normal device registration; Debian and openSUSE also issued advisories for affected packages.
Aug 28, 2026