High‑Impact Race Condition in Linux Kernel eMPIA USB Driver (CVE‑2026‑31583) Enables Local Code Execution
What It Is
A race‑condition flaw in the em28xx_v4l2 handling code of the Linux kernel’s eMPIA USB device driver permits an attacker with physical access to execute arbitrary code in kernel space. The vulnerability stems from missing locking around object operations, allowing unsynchronized manipulation that culminates in privileged code execution. No authentication is required.
Exploitability
The vulnerability is locally exploitable with physical presence; a proof‑of‑concept has been disclosed by the reporting researcher. The CVSS v3.1 base score is 7.1 (High), reflecting the ease of exploitation once the attacker is on‑site and the severe impact (complete system compromise). No known remote exploit exists, but the attack surface is broad across Linux distributions that ship the driver.
Affected Products
- Vendor: Linux (upstream kernel)
- Products: All kernel releases that include the eMPIA (
em28xx) USB driver prior to the 6.9.12 patch (the exact version range varies by distribution).
Why It Matters for Compliance & Audit Readiness
From a control‑assurance perspective, this flaw highlights gaps in access‑control and continuous monitoring regimes. Organizations must demonstrate that physical‑access policies are enforced and that privileged‑execution controls are documented and regularly validated. Evidence of timely patching, updated asset inventories, and logged verification of kernel integrity supports a defensible audit trail under frameworks such as NIST CSF PR.IP‑1 (Asset Management) and ISO 27001 A.12.1 (Operational Procedures).
Recommended Actions
- Patch Immediately: Apply the upstream kernel update (commit a66485a9…) or distribution‑specific security update that resolves CVE‑2026‑31583.
- Validate Kernel Version: Verify the running kernel version on all assets and confirm the patch is present.
- Update Asset Inventory: Tag systems that include the eMPIA driver and prioritize them for remediation.
- Enforce Physical Security Controls: Restrict unsupervised physical access to servers, workstations, and IoT devices that run Linux.
- Log & Monitor: Enable kernel audit logging for driver load events and monitor for anomalous USB device activity.
- Document Remediation: Record patch deployment dates, verification steps, and any compensating controls in your change‑management system to maintain audit readiness.
Source: Zero Day Initiative Advisory – ZDI‑26‑692 (CVE‑2026‑31583)