The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - media: as102: fix to not free memory after the device is registered in as102_usb_probe() In as102_usb     driver, the following race condition occurs: ``` CPU0 CPU1 as102_usb_probe() kzalloc(); // alloc     as102_dev_t .... usb_register_dev(); fd = sys_open(/path/to/dev); // open as102 fd ....
    usb_deregister_dev(); .... kfree(); // free as102_dev_t .... sys_close(fd); as102_release() // UAF!!     as102_usb_release() kfree(); // DFB!! ``` When a USB character device registered with usb_register_dev()     is later unregistered (via usb_deregister_dev() or disconnect), the device node is removed so new open()     calls fail. However, file descriptors that are already open do not go away immediately: they remain valid     until the last reference is dropped and the driver's .release() is invoked. In as102, as102_usb_probe()     calls usb_register_dev() and then, on an error path, does usb_deregister_dev() and frees as102_dev_t right     away. If userspace raced a successful open() before the deregistration, that open FD will later hit     as102_release() --> as102_usb_release() and access or free as102_dev_t again, occur a race to use-after-     free and double-free vuln. The fix is to never kfree(as102_dev_t) directly once usb_register_dev() has     succeeded. After deregistration, defer freeing memory to .release(). In other words, let release() perform     the last kfree when the final open FD is closed. (CVE-2026-31578)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-31578

high Nessus Plugin ID 310314

Version 1.3