Vulnerabilities
Linux Kernel eMPIA USB Driver Race Condition Enables Kernel Code Execution (CVE‑2026‑31583)
A race condition in the Linux kernel’s eMPIA USB device driver allows a physically present attacker to execute arbitrary code in kernel context without authentication. The flaw, rated CVSS 7.1, stems from missing locking on em28xx_v4l2 structures. Defenders should apply the kernel patch (commit a66485a934c7187ae8e36517d40615fa2e961cff) or update to a patched distribution version and consider disabling unused USB devices.
What happened
A race condition in the Linux kernel’s eMPIA USB device driver allows a physically present attacker to execute arbitrary code in kernel context without authentication.
Impact
The vulnerability (CVE‑2026‑31583) is rated CVSS 7.1 and can lead to full system compromise on affected kernel versions. It affects all distributions that ship an unpatched kernel containing the em28xx_v4l2 code path.
What to do
- Apply the upstream kernel patch (commit a66485a934c7187ae8e36517d40615fa2e961cff) or upgrade to a distribution release that includes the fix.
- If a patch is not yet available, disable or unplug unused USB devices that use the eMPIA driver.
- Verify kernel integrity and monitor for anomalous system calls or unexpected kernel module activity.
- Maintain a strict physical security policy to limit access to machines that may be targeted.
Linux has released the fix; vendors are advised to coordinate with their distribution maintainers for timely deployment.
Related vulnerabilities
Linux Kernel OpenvSwitch Race Condition Enables Local Privilege Escalation (CVE‑2026‑74465)
A race condition in the Linux kernel’s OpenvSwitch dp_meter handling allows local attackers to gain root privileges after executing low‑privileged code. The flaw is fixed in a kernel commit and requires immediate patching. Defenders should update kernels, audit OpenvSwitch usage, and monitor for suspicious dp_meter activity.
Read briefing
Microsoft Edge Vulnerability CVE‑2026‑106412: Race Condition in Chromium
A race condition in Chromium (CVE‑2026‑106412) affects Microsoft Edge users. The flaw can enable arbitrary code execution via malicious web content. Defenders should update Edge to the patched version and monitor for suspicious activity.
Read briefing
CVE‑2026‑83780: Windows CCFFilter Driver Remote Code Execution via Use‑After‑Free
Microsoft has disclosed a remote code execution flaw in the CCFFilter driver (CVE‑2026‑83780). The vulnerability, triggered by a use‑after‑free condition, can be exploited over the network by an unauthenticated attacker. Defenders should apply the latest security update, disable the driver on vulnerable systems, and enforce network segmentation.
Read briefing
Microsoft Edge Addresses Race Condition in Chromium Editing (CVE‑2026‑95360)
A race condition in Chromium’s editing engine could allow exploitation. Microsoft Edge (Chromium‑based) has incorporated the fix. Defenders should update to the latest Edge version to mitigate the risk.
Read briefing