Linux Kernel eMPIA USB Driver Vulnerable to Code Execution
A race condition in the Linux Kernel's eMPIA USB device driver allows physically present attackers to execute arbitrary code with a CVSS score of 7.1.
A critical vulnerability has been identified within the eMPIA USB device driver component of the Linux Kernel, allowing for arbitrary code execution. The flaw, tracked as CVE-2026-31583, stems from a race condition that arises due to improper locking mechanisms when handling em28xx_v4l2 structures. This means that under specific timing conditions, an attacker could manipulate the driver's state to gain control.
The vulnerability is particularly concerning as it requires only physical presence to exploit and does not necessitate any form of authentication. This significantly lowers the barrier to entry for attackers, making it a potent threat for systems that can be physically accessed. The CVSS v3.1 score for this vulnerability is rated at 7.1, classifying it as High severity.
Exploitation of this flaw allows a physically present attacker to execute arbitrary code within the context of the kernel. This level of access provides attackers with the highest possible privileges on the affected system, enabling them to compromise the entire operating system, install persistent malware, exfiltrate sensitive data, or disrupt system operations.
The Zero Day Initiative (ZDI) disclosed the vulnerability on September 14, 2026, following its initial report to the vendor on April 17, 2026. This coordinated disclosure timeline ensures that vendors have adequate time to develop and distribute patches before the vulnerability becomes widely known and potentially exploited.
Linux has since issued an update to address this vulnerability. The specific commit addressing the issue can be found in the Linux kernel repository at https://github.com/torvalds/linux/commit/a66485a934c7187ae8e36517d40615fa2e961cff. Users and administrators are strongly advised to apply this update as soon as possible to mitigate the risk of exploitation.
This vulnerability highlights the ongoing challenges in securing complex software like the Linux kernel, where even seemingly minor issues like race conditions in device drivers can lead to severe security implications. The reliance on physical access for exploitation, while a limiting factor, still poses a significant risk in environments with shared or accessible hardware.