CVE-2024-26875

What it actually does

Use-after-free in pvr2_context_set_notify when disconnect_flag assignment races with context release, allowing a freed slab object to be read in the USB hub workqueue context.

Why it matters to the business

Kernel memory corruption on systems exposing the pvrusb2 USB video capture driver can lead to system instability, crashes, or local code execution; urgency remains low given absence from KEV and flat EPSS trend.

How an attack unfolds

An attacker with local access attaches a pvrusb2-compatible USB device, triggers pvr2_context_disconnect which sets the flag and frees the context in one task while a concurrent kworker still calls pvr2_context_set_notify on the dangling pointer, resulting in the slab-use-after-free observed by syzbot.

How to fix it

Apply the upstream fix by updating the Linux kernel to include commit ed8000e1e8e9684ab6c30cf2b526c0cea039929c in the pvrusb2-context.c file; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the presence of commit ed8000e1e8e9684ab6c30cf2b526c0cea039929c in the running kernel source or verify that pvr2_context_disconnect no longer performs the flag assignment before all context references are released.

Typical attack path

1. Attach pvrusb2 USB hardware or emulate the device
2. Initiate disconnect via usb_hub_wq hub_event
3. Race pvr2_context_check freeing mp against pvr2_context_set_notify read
4. Trigger KASAN-detected slab-use-after-free for denial of service or further corruption

How to detect it

Search kernel logs and KASAN reports for slab-use-after-free mentions of pvr2_context_set_notify or pvrusb2-context.c; correlate with usb_hub_wq activity and pvr2_context_thread_func exits.

• pvr2_context_set_notify+0x2c4/0x310
• pvrusb2-context.c:35
• BUG: KASAN: slab-use-after-free in pvr2_context_set_notify

What your security team should do

• Prioritize kernel upgrade to the fixed commit on any system exposing the pvrusb2 driver
• Blacklist the pvrusb2 module if the hardware is not required
• Monitor for future syzbot or CVE reports affecting the same driver family
• Test the updated kernel in a staging environment before broad deployment