There is a use-after-free in the usbtv driver, on an error path of the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10. This allows an attacker to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure.
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1538929]
This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7, MRG-2 and real time kernels as the code which can trigger the flaw is not present in the products listed.
This was fixed for Fedora with the 4.15.16 stable updates.