CVE-2024-1642470

Vulnerabilidad de ejecución remota de código en el controlador principal genérico USB de Windows CVE-2024-1642470 Descripción general Este repositorio contiene un código de explotación de prueba de concepto PoC y un script de detección para la vulnerabilidad de ejecución remota de código en el...

CVE-2019-14079

Fuzzing de dispositivos USB en Android CVE-2019-14079 Esta publicación de blog trata sobre un error simple que encontré en mi dispositivo Android MI A2 - ejecuta Android de stock mediante fuzzing de dispositivos USB y que Google marcó como de gravedad alta. El error estaba en el controlador USB d...

CVE-2026-97977

A flaw was found in the Linux kernel's Bluetooth USB driver. A race condition during device closure or disconnection allows background receive tasks to continue running after the associated device data has been released, leading to a use-after-free UAF condition. A local attacker could exploit th...

CVE-2026-97539

A flaw was found in the Linux kernel's xusbatm USB driver. When dynamic device identifiers are configured, the driver improperly performs pointer arithmetic on heap-allocated identifiers, resulting in an out-of-bounds array access. A local user could exploit this flaw to cause a Denial of Service...

PT-2026-98479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xusbatm USB driver where the code relies on pointer arithmetic for the usb device id parameter during the probe process. When dynamic IDs are involved, this...

kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb

A use-after-free flaw was found in the Linux kernel's Bluetooth USB driver. The btusb driver binds to multiple USB interfaces INTF, ISOC, DIAG but allocates its data structure with devmkzalloc tied to a single interface. When that interface is released, the memory is freed while other interfaces...

kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb

A use-after-free flaw was found in the Linux kernel's Bluetooth USB driver. The btusb driver binds to multiple USB interfaces INTF, ISOC, DIAG but allocates its data structure with devmkzalloc tied to a single interface. When that interface is released, the memory is freed while other interfaces...

CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16147

The ITE IT82xx2 USB device-controller driver in Zephyr RTOS (drivers/usb/udc/udc_it82xx2.c) contains a use-after-free caused by premature buffer submission during multi-packet OUT transfers. When a full max-packet-size packet arrives before the buffer is complete, the driver both re-arms the endp...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The mcbausb driver fails to populate the ndochangemtu function, allowing for a buffer overflow. Sending a PFPACKET message allows bypassing the CAN driver’s logic and directly reaching the xmit function of the CAN driver. The onl...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbxmitcallback: fixed the handling of failed transmitted URBs. The driver lacks the necessary cleanup steps after failed transfers of URBs. This results in one fewer available URB per error. This leads to reduced...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: qcom: A memory leak has been fixed in dwc3qcominterconnectinit. In the alloc Resources for path handle function of oficcget, resources should be released when they are no longer needed. This should be done similarly in...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: media: radio-shark: Added endpoint checks The syzbot fuzzer was able to trigger a WARNING message from the radio-shark2 driver: ------------ Cut here ------------ usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 327...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Use usbbulkmsgkillable with user-specified timeouts. The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for certain usbbulkmsg calls. Since the user can specif...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: emsusbreadbulkcallback: fixed the URB memory leak. The memory leak was fixed in a similar manner to the issue in commit 7352e1d5932a “can: gsusb: gsusbreceivebulkcallback: fixed the URB memory leak”. In emsusbopen, t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Flushing anchored URBs in usbtmcrelease When calling usbtmcrelease, pending anchored URBs User Representation Blocks must be flushed or terminated to prevent use-after-free errors e.g., in the HCD Human Computer...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the hsofreenetdevice function in drivers/net/usb/hso.c calls unregisternetdev from version 5.13.4 onwards, without checking the NETREGREGISTERED status. This leads to a use-after-free and a double-free...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btusb: Added a NULL check for “date-evtskb”. Fixed a crash due to NULL pointers. 6104.969662 BUG: NULL pointer dereferencing in the kernel; address: 00000000000000c8 6104.969667 PF: Supervisor read access in kernel...