In the Linux kernel, the following vulnerability has been resolved:

media: as102: fix to not free memory after the device is registered in as102usbprobe()

In as102usb driver, the following race condition occurs: CPU0 CPU1 as102usbprobe() kzalloc(); // alloc as102devt .... usbregisterdev(); fd = sysopen("/path/to/dev"); // open as102 fd .... usbderegisterdev(); .... kfree(); // free as102devt .... sysclose(fd); as102release() // UAF!! as102usbrelease() kfree(); // DFB!!

When a USB character device registered with usbregisterdev() is later unregistered (via usbderegisterdev() or disconnect), the device node is removed so new open() calls fail. However, file descriptors that are already open do not go away immediately: they remain valid until the last reference is dropped and the driver's .release() is invoked.

In as102, as102usbprobe() calls usbregisterdev() and then, on an error path, does usbderegisterdev() and frees as102devt right away. If userspace raced a successful open() before the deregistration, that open FD will later hit as102release() --> as102usbrelease() and access or free as102devt again, occur a race to use-after-free and double-free vuln.

The fix is to never kfree(as102devt) directly once usbregisterdev() has succeeded. After deregistration, defer freeing memory to .release().

In other words, let release() perform the last kfree when the final open FD is closed.