CVE-2026-31578

In the Linux kernel, the following vulnerability has been resolved:

media: as102: fix to not free memory after the device is registered in as102_usb_probe()

In as102_usb driver, the following race condition occurs:

```

CPU0 CPU1

as102_usb_probe()

kzalloc(); // alloc as102_dev_t

....

usb_register_dev();

fd = sys_open("/path/to/dev"); // open as102 fd

....

usb_deregister_dev();

....

kfree(); // free as102_dev_t

....

sys_close(fd);

as102_release() // UAF!!

as102_usb_release()

kfree(); // DFB!!

```

When a USB character device registered with usb_register_dev() is later

unregistered (via usb_deregister_dev() or disconnect), the device node is

removed so new open() calls fail. However, file descriptors that are

already open do not go away immediately: they remain valid until the last

reference is dropped and the driver's .release() is invoked.

In as102, as102_usb_probe() calls usb_register_dev() and then, on an

error path, does usb_deregister_dev() and frees as102_dev_t right away.

If userspace raced a successful open() before the deregistration, that

open FD will later hit as102_release() --> as102_usb_release() and access

or free as102_dev_t again, occur a race to use-after-free and

double-free vuln.

The fix is to never kfree(as102_dev_t) directly once usb_register_dev()

has succeeded. After deregistration, defer freeing memory to .release().

In other words, let release() perform the last kfree when the final open

FD is closed.