HIGH
hwmon powerz URB UAF
CVE-2026-31582
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Fix use-after-free on USB disconnect After powerz_disconnect() frees the URB and releases the mutex, a subsequent powerz_read() call can acquire the mutex and call powerz_read_data(), which dereferences the freed URB pointer. Fix by: - Setting priv->urb to NULL in powerz_disconnect() so that powerz_read_data() can detect the disconnected state. - Adding a !priv->urb check at the start of powerz_read_data() to return -ENODEV on a disconnected device. - Moving usb_set_intfdata() before hwmon registration so the disconnect handler can always find the priv pointer.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability in the POWER-Z USB hardware monitor driver can be triggered by physically disconnecting the device during active monitoring operations. This could potentially lead to system crashes or memory corruption, though exploitation requires physical access to the USB device.
Vulnerability analysis
Root Cause: Race condition between USB disconnect and read operations. When powerz_disconnect() is called, it frees the URB (USB Request Block) and releases the mutex. However, a concurrent powerz_read() call can acquire the mutex after the URB is freed and call powerz_read_data(), which then dereferences the freed URB pointer, causing a use-after-free vulnerability.
Attack Surface: Local attack surface requiring physical USB access. An attacker would need to physically disconnect a POWER-Z USB monitoring device while the driver is actively reading data, creating a race condition window for exploitation.
Fix Mechanism: The patch implements three defensive measures: (1) Sets priv->urb to NULL in powerz_disconnect() to mark the disconnected state, (2) Adds a NULL check at the start of powerz_read_data() to return -ENODEV when the device is disconnected, and (3) Moves usb_set_intfdata() before hwmon registration to ensure the disconnect handler can always find the private data structure.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.83 | c78e1d4e48f2 |
| 6.18 | 6.18.24 | 9e1b798257f9 |
| 6.19 | 6.19.14 | 7003ae4810ca |
| 7.0 | 7.0.1 | 61f2aa23b0ce |
| mainline | 7.1-rc1 | 08e57f5e1a90 |