Linux Kernel Streamzap Device Disconnection Race Condition Vulnerability

A race condition vulnerability has been identified in the Linux kernel's handling of Streamzap devices. This issue arises in the streamzap_disconnect() function, where the order of operations allows for a NULL pointer dereference. Specifically, rc_unregister_device() is called before usb_kill_urb(), leading to a general protection fault. When rc_unregister_device() frees the dev->raw pointer, it can disrupt the streamzap_callback() handler if the disconnection occurs before the handler has completed, causing a crash by accessing freed resources.

Impact

Exploitation of this vulnerability leads to a general protection fault caused by a NULL pointer dereference, crashing the system.