PT-2026-34934 · Linux · Linux Kernel

CVE-2026-31582

·

Published

2026-04-24

·

Updated

2026-07-28

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description A use-after-free issue exists in the hwmon powerz component during USB disconnection. When powerz disconnect() frees the URB (USB Request Block) and releases the mutex, a subsequent call to powerz read() can acquire the mutex and trigger powerz read data(), which then dereferences the freed URB pointer.
Recommendations Set priv->urb to NULL in powerz disconnect() to allow powerz read data() to detect the disconnected state. Add a !priv->urb check at the beginning of powerz read data() to return -ENODEV for disconnected devices. Move usb set intfdata() before hwmon registration to ensure the disconnect handler can always locate the priv pointer.

Exploit

Fix

Use After Free

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-31582
OPENSUSE-SU-2026:10703-1
USN-8488-1
USN-8488-2
USN-8507-1
USN-8567-1
USN-8569-1
USN-8574-1
USN-8574-2
USN-8574-3
USN-8595-1
USN-8595-2
USN-8595-3
USN-8596-1
USN-8603-1
USN-8606-1
USN-8607-1
USN-8608-1
USN-8609-1
USN-8619-1

Affected Products

Linux Kernel