Loading story…
A use-after-free vulnerability in the Linux kernel's ALSA USB-audio driver can be triggered while probing a malicious USB sound device that reports zero interfaces. In usb_audio_probe, the error path could free the card object before decrementing chip->active, leaving the driver to access a counter in freed memory. The flaw, present in code dating to around Linux kernel 3.1, may provide a local attacker with a kernel write primitive through a physically attached USB peripheral.
Commit 5f8cf712582617d523120df67d392059eaf2fc4b corrects the ordering by decrementing the active-chip counter before the card can be freed, and was designated for stable-kernel backporting. The issue was identified during fuzzing of hardware/software interfaces; researchers warned that malicious USB devices could potentially facilitate root compromise or screen-lock bypass on affected desktops and Android devices.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Takashi Iwai committed patch 5f8cf712582617d523120df67d392059eaf2fc4b, which moves the active-chip counter decrement before a potential card-object free in sound/usb/card.c. The fix was submitted for stable-kernel backport consideration.
Hui Peng and Mathias Payer reported a use-after-free write vulnerability in the Linux kernel's USB-audio probing code, discovered while fuzzing malicious USB peripheral interactions. Exploitation required local or physical access to attach a crafted malicious USB device and could provide a kernel write primitive.
The vulnerable USB-audio error-path behavior originated with a Linux 3.1-era development change, which could free the card object before decrementing its embedded active-chip counter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A use-after-free vulnerability, tracked as **CVE-2019-19530**, affected the Linux kernel's USB CDC-ACM driver in `drivers/usb/class/cdc-acm.c`. A malicious USB device could trigger the flaw on Linux kernel versions before **5.2.10**, potentially compromising the affected system through unsafe handling of the USB control-interface object's lifetime. The upstream fix, commit `c52873e5a1ef72f845526d9f6a50704433f9c625`, acquires the USB control-interface reference before CDC-ACM minor-number allocation and removes a later duplicate reference acquisition. The driver's destructor releases the retained reference, correcting cleanup behavior during failed allocation and normal device registration; Debian and openSUSE also issued advisories for affected packages.
Aug 28, 2026
A use-after-free flaw in the Linux kernel's `ath9k_htc` Atheros USB Wi-Fi driver, tracked as **CVE-2022-1679**, can be triggered by a local low-privileged user using crafted input messages. The bug occurs when driver initialization fails after `drv_priv` is assigned: hardware-private data may be freed while an asynchronous receive callback still accesses it, causing a kernel crash and potentially exposing memory. The original report also identified a possible privilege-escalation condition. Red Hat assigned the issue a Moderate severity rating with CVSS 7.0 and released fixes for supported Red Hat Enterprise Linux 8 and 9 kernel variants. Although exploitation for privilege escalation is assessed as unlikely because it depends on difficult race conditions, organizations should deploy updated kernels or prevent the `ath9k` module from loading where the adapter is not needed. RHEL 6 and 7 kernel packages are outside support scope and should be treated as affected unless mitigated or upgraded.
Aug 26, 2026
Multiple Linux kernel HID and force-feedback drivers contained out-of-bounds write vulnerabilities tracked as **CVE-2019-19532**. A malicious USB HID device could trigger the flaws on kernels earlier than `5.3.9`, affecting drivers for force-feedback hardware from vendors including Logitech, Microsoft, Sony, and Holtek. The upstream fix in commit `d9d4b1e46d95` validates that a HID device has input entries before drivers access the first `hid_input` structure. Drivers now log “no inputs found” and return `-ENODEV` for malformed devices, preventing invalid list access that could cause kernel crashes or denial of service. Organizations using affected Linux kernels should deploy kernel `5.3.9` or applicable vendor security updates from Ubuntu, Debian, or openSUSE.
Aug 28, 2026