VYPR
← All advisories
Medium severity6.6NVD Advisory· Published Nov 7, 2017· Updated May 13, 2026

CVE-2017-16644

CVE-2017-16644

Description

The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A flaw in the Linux kernel's hdpvr driver allows local users to cause a denial of service via a crafted USB device.

Vulnerability

The vulnerability resides in the hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c of the Linux kernel through version 4.13.11. When a crafted USB device is inserted, improper error handling in the probe function leads to a lockdep warning and subsequent system crash [2]. The code path is triggered during USB device enumeration when the driver attempts to register a non-static key without proper lockdep annotation.

Exploitation

An attacker with physical access or the ability to insert a malicious USB device can trigger the vulnerability. No authentication is required; the device is automatically probed by the kernel when connected. The syzkaller fuzzer reproduced the issue by emulating a malicious USB device that causes the hdpvr_probe function to call flush_work on an uninitialized workqueue, resulting in a kernel crash [2].

Impact

Successful exploitation results in a denial of service (system crash). The crash is caused by a lockdep warning that halts the system. The CVE description also mentions the possibility of "unspecified other impact," but no further details are provided in the available references.

Mitigation

The issue was addressed in a kernel patch submitted to the linux-media mailing list [3]. Users should update to a Linux kernel version containing the fix. If a patched kernel is not available, the risk can be mitigated by restricting physical access to USB ports and not allowing untrusted USB devices.

References
  1. usb/media/hdpvr: trying to register non-static key in hdpvr_probe
  2. Making sure you're not a bot!

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

95

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.