usb: storage: realtek_cr: fix use-after-free on disconnect (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 10 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: usb: storage: realtek_cr: fix use-after-free on disconnect realtek_cr_destructor() calls timer_delete() before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a use-after-free. Use timer_shutdown_sync() to wait for the callback and prevent further rearming. Do this unconditionally because ss_en may be changed after the timer is armed. Move timer_setup() into init_realtek_cr() so the timer is initialized before any failure path can invoke the destructor. Found by static analysis.
References
- https://git.kernel.org/stable/c/f98c2f119fcd81cfede114d2fd3463a17aed8209
- https://git.kernel.org/stable/c/0935e57ede003bbe35de9c5d6a49260999ca0314
- https://git.kernel.org/stable/c/c1e7e35100efffba7c9e1dfa76519d6cd323ba3d
- https://git.kernel.org/stable/c/524d4257f741cd95eb85e2817c9c890928fcfef7
- https://git.kernel.org/stable/c/7c4e2f964c65dea4ea22386799d5fb10ef1e3e54
- https://git.kernel.org/stable/c/cae9dbba6adae21a04a3bd045e07b489847ff2c6
- https://git.kernel.org/stable/c/4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc
European references
- ENISA EUVD · EUVD-2026-80637
- GCVE · GCVE-0-2026-90029
CERT-FR advisories
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1374 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected e931830bb877e2aad9a1be83506f9bdb26c91e4e < f98c2f119fcd81cfede114d2fd3463a17aed8209 ; affected e931830bb877e2aad9a1be83506f9bdb26c91e4e < 0935e57ede003bbe35de9c5d6a49260999ca0314 ; affected e931830bb877e2aad9a1be83506f9bdb26c91e4e < c1e7e35100efffba7c9e1dfa76519d6cd323ba3d ; affected e931830bb877e2aad9a1be83506f9bdb26c91e4e < 524d4257f741cd95eb85e2817c9c890928fcfef7 ; affected e931830bb877e2aad9a1be83506f9bdb26c91e4e < 7c4e2f964c65dea4ea22386799d5fb10ef1e3e54 ; affected e931830bb877e2aad9a1be83506f9bdb26c91e4e < cae9dbba6adae21a04a3bd045e07b489847ff2c6 |
| Linux · Linux | affected 3.1 ; unaffected 0 < 3.1 ; unaffected 5.15.224 ≤ 5.15.* ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.112 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |