In the Linux kernel’s hackrf media driver, a race condition allows memory allocated for the hackrf_dev structure to be freed while still referenced by open file descriptors. This premature free produces a use‑after‑free followed by a double‑free on device unregister and release, enabling kernel memory corruption, system crashes, or arbitrary code execution. The weakness is classified as a race condition and memory safety violation (CWE‑364, CWE‑416).

All Linux kernel builds that include the hackrf driver are affected; any kernel version before the patch that removes the premature kfree call in hackrf_probe() is vulnerable. The flaw exists on any host where the hackrf driver is loaded and the /dev/hackrf device is exposed to userspace. Administrators should verify whether the hackrf module is in use on each system.

The CVSS score of 7.8 marks this as high severity, and an EPSS score of less than 1 % indicates a low but non‑zero likelihood of exploitation. The issue requires a local attacker with access to the /dev/hackrf device to open it during the probe/unregister race, potentially leading to kernel memory corruption or privilege escalation. Although it is not currently listed in CISA’s KEV catalog, the presence of a race condition warrants prompt mitigation.