{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.85-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.14-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  media: hackrf: fix to not free memory after the device is registered in hackrf_probe()  In hackrf driver, the following race condition occurs: ``` \t\tCPU0\t\t\t\t\t\tCPU1 hackrf_probe()   kzalloc(); // alloc hackrf_dev   ....   v4l2_device_register();   .... \t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd \t\t\t\t\t\t....   v4l2_device_unregister();   ....   kfree(); // free hackrf_dev   .... \t\t\t\t\t\tsys_ioctl(fd, ...); \t\t\t\t\t\t  v4l2_ioctl(); \t\t\t\t\t\t    video_is_registered() // UAF!! \t\t\t\t\t\t.... \t\t\t\t\t\tsys_close(fd); \t\t\t\t\t\t  v4l2_release() // UAF!! \t\t\t\t\t\t    hackrf_video_release() \t\t\t\t\t\t      kfree(); // DFB!! ```  When a V4L2 or video device is unregistered, the device node is removed so new open() calls are blocked.  However, file descriptors that are already open-and any in-flight I/O-do not terminate immediately; they remain valid until the last reference is dropped and the driver's release() is invoked.  Therefore, freeing device memory on the error path after hackrf_probe() has registered dev it will lead to a race to use-after-free vuln, since those already-open handles haven't been released yet.  And since release() free memory too, race to use-after-free and double-free vuln occur.  To prevent this, if device is registered from probe(), it should be modified to free memory only through release() rather than calling kfree() directly.",
  "id": "DEBIAN-CVE-2026-31576",
  "modified": "2026-09-14T16:47:36.565656800Z",
  "published": "2026-04-24T15:16:32.230Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-31576"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-31576"
  ]
}