LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26875: media: pvrusb2: fix uaf in pvr2_context_set_notify

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix uaf in pvr2_context_set_notify [Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26 CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: usb_hub_wq hub_event Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline] pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272 Freed by task 906: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x105/0x340 mm/slub.c:4409 pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline] pvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158 [Analyze] Task A set disconnect_flag = !0, which resulted in Task B's condition being met and releasing mp, leading to this issue. [Fix] Place the disconnect_flag assignment operation after all code in pvr2_context_disconnect() to avoid this issue.

MediumCVSS 6.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel use-after-free bug in the pvrusb2 USB media driver. It can potentially affect confidentiality, integrity, and availability, but the CVSS vector requires local access, high complexity, and high privileges. Treat it as a kernel maintenance priority, especially where USB media hardware or broad kernel attack surface matters.

Executive priority

Schedule remediation through normal kernel patch cycles, with faster handling for shared, privileged, or device-accessible systems. This is not supported as internet-exploited in the sources, but kernel memory safety bugs can carry high impact if reachable.

Technical view

The flaw is CWE-416 in drivers/media/usb/pvrusb2/pvrusb2-context.c. A race around disconnect handling can free a context while pvr2_context_set_notify still reads it. The source states the fix moves disconnect_flag assignment later in pvr2_context_disconnect to avoid premature release.

Likely exposure

Exposure is likely limited to Linux systems running affected kernels with the pvrusb2 driver present or loadable. The bundle lists Linux kernel affected ranges and stable fixes, but exact distro package status should be verified against vendor advisories.

Exploitation context

No active exploitation is supported by the provided sources, and KEV is false. The CVSS vector indicates local, high-complexity exploitation requiring high privileges, with no user interaction. Public evidence here comes from syzbot/KASAN crash analysis and kernel stable fixes.

Researcher notes

The key condition is a disconnect race: one task sets disconnect_flag, another observes it and releases mp, then pvr2_context_set_notify reads freed memory. The provided material does not establish a practical exploit path or affected non-Linux products beyond referenced vendor advisories.

Mitigation direction

  • Upgrade to a vendor kernel containing the referenced stable pvrusb2 fix.
  • Prioritize affected hosts that permit local privileged users or USB media device access.
  • Check Debian, Siemens, and other vendor advisories for packaged fixed versions.
  • If upgrades are delayed, review whether pvrusb2 is needed on exposed systems.

Validation and detection

  • Inventory Linux kernel versions and compare them with vendor fixed package advisories.
  • Check whether the pvrusb2 module is present, loadable, or in use.
  • Confirm deployed kernels include one of the referenced stable commits or downstream backports.
  • Review kernel logs for pvrusb2 disconnect crashes, KASAN reports, or related instability.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-416: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-26875 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
13Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.4CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H0.55.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

6.4Medium
CVSS 3.1 vector shape for CVE-2024-26875Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308, e5be15c63804e05b5a94197524023702a259e308unaffected
LinuxLinux2.6.26, 0, 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9affected
Weakness

CWE details

CWE-416

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.