Loading story…
Google’s syzkaller project documents an external USB fuzzing framework that exercises Linux kernel USB drivers in local or virtualized environments without physical USB-emulation hardware or QEMU usbredir. The framework uses Raw Gadget with Dummy HCD/UDC controllers, KCOV coverage collection, and USB pseudo-syscalls to emulate enumeration, control requests, and endpoint traffic; an upstream USB-focused syzbot manager is also tracking fuzzing results.
The capability targets a subsystem with a record of memory-safety flaws reachable by malicious USB devices. Earlier syzkaller research identified 15 Linux USB vulnerabilities, including NULL-pointer dereferences, use-after-free bugs, and a double-free; 13 had upstream fixes while CVE-2019-15290 and CVE-2019-15291 were still unpatched at the time of disclosure. Organizations should prioritize supported kernel updates and restrict untrusted USB peripherals, while noting that the current fuzzing implementation does not support USB 3 or isochronous transfers.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Andrey Konovalov disclosed 15 Linux kernel USB-subsystem vulnerabilities, including NULL-pointer dereferences, use-after-free flaws, and a double-free that malicious USB devices could trigger to crash a system or USB worker thread. Thirteen issues had upstream fixes, while CVE-2019-15290 and CVE-2019-15291 remained unpatched despite prior syzbot reports.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
syzkaller.appspot.com
Open sourcegithub.com
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers extended **Syzkaller** with a Syzlang grammar for crafted Ethernet frames to fuzz previously uncovered packet-reception paths in Linux’s `batman-adv` mesh-networking subsystem, particularly code in `routing.c` that had received no Syzbot coverage. The approach follows established work on exposing kernel networking interfaces to external-input fuzzing and targets protocol parsers reachable through network traffic rather than only local syscall surfaces. The campaign identified three defects: a 16-bit integer overflow in OGM fragmentation, a use-after-free race in the throughput-meter path during interface deletion, and a TT TVLV VLAN-length truncation that can produce an out-of-bounds read. The researchers’ overflow fix has been merged into Linux mainline, while patches for the use-after-free were already circulating on kernel mailing lists; organizations using `batman-adv` should track kernel updates and prioritize remediation as fixes become available.
Sep 1, 2026
Linux kernel fuzzing tools are continuing to surface hard-to-find defects in core subsystems, with coverage-guided testing and automated crash reporting helping developers trace bugs across memory management, concurrency, and system call interactions. The reporting highlights the `syzkaller` ecosystem—`syz-manager`, `syz-executor`, and `syzbot`—alongside kernel instrumentation such as `KCOV`, **KASAN**, and **KCSAN**, which are used to expand code coverage and detect memory-safety and race-condition issues during testing. One cited case involved a `syzbot`-tracked socket memory accounting warning, identified as `de6565462ab540f50e47`, that was traced to a signedness flaw in TCP socket buffer remaining-space calculations. The bug corrupted internal accounting and was fixed upstream in Linux kernel commit `d3a5f2871adc`, titled **"tcp: Correct signedness in skb remaining space calculation"**. The reporting also notes that `syzbot` crash reports do not automatically indicate exploitable vulnerabilities, because some crashes require privileged conditions or have limited security impact.
Aug 3, 2026
Multiple Linux kernel HID and force-feedback drivers contained out-of-bounds write vulnerabilities tracked as **CVE-2019-19532**. A malicious USB HID device could trigger the flaws on kernels earlier than `5.3.9`, affecting drivers for force-feedback hardware from vendors including Logitech, Microsoft, Sony, and Holtek. The upstream fix in commit `d9d4b1e46d95` validates that a HID device has input entries before drivers access the first `hid_input` structure. Drivers now log “no inputs found” and return `-ENODEV` for malformed devices, preventing invalid list access that could cause kernel crashes or denial of service. Organizations using affected Linux kernels should deploy kernel `5.3.9` or applicable vendor security updates from Ubuntu, Debian, or openSUSE.
Aug 28, 2026