CVE-2026-31576: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31576 Overview

CVE-2026-31576 is a use-after-free and double-free vulnerability in the Linux kernel hackrf media driver. The flaw exists in the hackrf_probe() error path, where the driver calls kfree() on the device structure after the device has already been registered with V4L2. Open file descriptors and in-flight I/O remain valid until the last reference is released, creating a race window in which freed memory is accessed through v4l2_ioctl() and v4l2_release(). The vulnerability is tracked as CWE-416 Use After Free and affects multiple Linux kernel versions.

Critical Impact
A local attacker holding an open file descriptor to the hackrf device can trigger memory corruption leading to kernel-level code execution or denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to the patch commits)
Distributions shipping the hackrf media driver (drivers/media/usb/hackrf/)
Systems with HackRF Software Defined Radio (SDR) USB devices supported by the in-tree driver

Discovery Timeline

2026-04-24 - CVE-2026-31576 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31576

Vulnerability Analysis

The hackrf driver allocates a hackrf_dev structure with kzalloc() during hackrf_probe() and subsequently registers it through v4l2_device_register(). On a later error path within probe, the driver invokes v4l2_device_unregister() followed by an immediate kfree() on the device memory. Unregistering removes the device node and prevents new open() calls, but it does not invalidate file descriptors already opened on a parallel CPU. Those descriptors continue to reference the now-freed hackrf_dev structure.

When the second thread later issues sys_ioctl() or sys_close(), the kernel dispatches into v4l2_ioctl() and v4l2_release(), which in turn call video_is_registered() and hackrf_video_release() on freed memory. Because hackrf_video_release() itself calls kfree() on the same allocation, the race produces both a use-after-free and a double-free.

Root Cause

The driver violates the V4L2 lifetime model. Once a device is registered, ownership of the backing memory must transfer to the release() callback, which only runs after the final reference is dropped. Freeing memory directly in the probe error path while open handles still exist breaks this contract.

Attack Vector

Exploitation requires local access and an open file descriptor on the hackrf character device, which typically lives under /dev/swradio* or /dev/video*. An attacker races a controlled probe failure (for example by manipulating USB device state or triggering driver re-binding) against an open descriptor to land operations on the freed allocation. Successful exploitation of the use-after-free can corrupt kernel slab memory, leading to privilege escalation or kernel crash. See the upstream fix in Kernel Git Commit 45cbaf5c for the corrected lifecycle handling.

Detection Methods for CVE-2026-31576

Indicators of Compromise

Kernel oops or panic messages referencing hackrf_video_release, v4l2_release, or video_is_registered with KASAN use-after-free or double-free reports
Unexpected slub corruption warnings (general protection fault, BUG: KASAN: use-after-free) tied to media subsystem call stacks
Repeated USB probe/disconnect cycles for HackRF or other V4L2 SDR devices on a host with concurrent /dev/swradio* access

Detection Strategies

Enable CONFIG_KASAN and CONFIG_SLUB_DEBUG in test or canary builds to surface the underlying memory error at runtime
Audit installed kernel versions against the fix commits listed in the kernel.org stable advisories to identify unpatched hosts
Monitor dmesg and journald for kernel stack traces involving the hackrf or videodev modules

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on call stacks containing hackrf_, v4l2_release, or KASAN markers
Track loaded modules across the fleet and flag systems where the hackrf module is loaded but kernel build predates the fix
Correlate USB hotplug events with V4L2 device-node access to identify anomalous race-style usage patterns

How to Mitigate CVE-2026-31576

Immediate Actions Required

Apply the upstream kernel patches referenced below to all affected systems and reboot to load the corrected kernel
On hosts that do not require SDR functionality, blacklist the hackrf module via /etc/modprobe.d/ to remove the attack surface
Restrict access to /dev/swradio* and /dev/video* device nodes to trusted users through group ownership and udev rules

Patch Information

The fix modifies hackrf_probe() so that once v4l2_device_register() has succeeded, memory is released only through the release() callback rather than via direct kfree() on error paths. Patches are available in the stable trees at Kernel Git Commit 07e9e67, Kernel Git Commit 2145c71, Kernel Git Commit 3b7da2b, Kernel Git Commit 45cbaf5c, Kernel Git Commit 98a0a81, and Kernel Git Commit fcd1d70.

Workarounds

Unload and blacklist the hackrf driver where SDR functionality is not required
Physically remove or disallow HackRF USB devices on production systems using USB authorization policies
Restrict device-node permissions so only privileged service accounts can open /dev/swradio*

bash

# Blacklist the hackrf module until the kernel is patched
echo 'blacklist hackrf' | sudo tee /etc/modprobe.d/blacklist-hackrf.conf
sudo rmmod hackrf 2>/dev/null || true
sudo update-initramfs -u