Skip to main content

Linux Kernel CVE-2026-53025

| EUVDEUVD-2026-38893 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-4c74-g9cq-vhc5
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access to host
  2. Delivery
    Open greybus raw cdev handle
  3. Exploit
    Raw bundle disconnects, gb_raw freed
  4. Execution
    close() triggers cdev_put on freed memory
  5. Persist
    Kernel refcount underflow / use-after-free
  6. Impact
    DoS or memory corruption

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local access to a system where the greybus 'raw' driver (CONFIG_GREYBUS_RAW) is built and loaded, and the attacker must be able to open the greybus raw character device (PR:L per CVSS - a local low-privileged but device-accessible user). The use-after-free is triggered specifically by the sequence: hold an open cdev handle, have the raw bundle disconnected, then close the handle. Exploitation is sharply limited by the niche nature of the driver (staging code rarely enabled in production), the need for local access, and dependence on the bundle disconnect occurring while a handle is open; the demonstrated impact is a refcount-underflow panic, with the panic most reliably surfaced when CONFIG_INIT_ON_FREE_DEFAULT_ON=y.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) indicates a local, low-complexity, low-privilege vector with high CIA impact - plausible since a UAF can in principle be steered toward disclosure or code execution, though the description only demonstrates a refcount underflow/panic (denial of service) and the intelligence tag is 'Information Disclosure'. The low EPSS (0.16%) and absence of KEV/POC signals point to no active or widespread exploitation; this is a real correctness bug but a low operational priority for most fleets. A key limiting factor not captured by the score: the greybus raw driver is staging code that is rarely compiled or loaded in production, and exploitation requires local access to an open raw cdev - so realistic exposure is far narrower than the 7.8 implies. The CVE assigns no CWE (N/A), but the description unambiguously describes a use-after-free (CWE-416); treat the CIA:H rating as the theoretical UAF ceiling rather than a demonstrated RCE.
Exploit ScenarioDerived

A local user with permission to open the greybus raw character device opens the /dev node, then arranges for (or waits for) the underlying raw bundle to be disconnected, which frees the backing gb_raw object. When the user subsequently closes the file descriptor, cdev_put dereferences freed memory, crashing the kernel or potentially being groomed for further memory corruption; no public exploit is known and the path requires local access with an open handle.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Use-after-free in the Linux kernel's greybus 'raw' driver (drivers/staging/greybus/raw.c) allows a local user holding an open character-device handle to trigger memory corruption when the underlying raw bundle is disconnected and the application later closes the cdev. The flaw stems from the gb_raw structure (which embeds the cdev) being freed in the disconnect callback while a userspace reference remains, causing cdev_put to operate on freed memory and a refcount underflow/panic, especially with CONFIG_INIT_ON_FREE_DEFAULT_ON=y. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), consistent with a local, niche-driver issue.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply a kernel build that includes stable commits ef2d97c15b19b3489de01695bce478601e236c3e and 983cc2c7efbce04ecbf6328448d895044dd6ab31 (corresponding to stable lines reported as 7.0.10 and 7.1 in EUVD), available via https://git.kernel.org/stable/c/ef2d97c15b19b3489de01695bce478601e236c3e and https://git.kernel.org/stable/c/983cc2c7efbce04ecbf6328448d895044dd6ab31. Because greybus is staging code, the most effective compensating control where the fix cannot be deployed is to not build or load the driver: ensure CONFIG_GREYBUS_RAW is unset, or blacklist/unload the gb_raw module (modprobe -r gb_raw and add to /etc/modprobe.d blacklist), which fully removes the attack surface at the cost of losing greybus raw functionality. If the driver must remain loaded, restrict permissions on the greybus raw /dev character device so only trusted accounts can open it, reducing which local users can reach the vulnerable close() path; note this does not fix the underlying UAF and only narrows exposure.

Affected VersionsENISA

Linux patch: 0
Linux patch: 7.1
Linux e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <ef2d97c15b19b3489de01695bce478601e236c3e
Linux e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <983cc2c7efbce04ecbf6328448d895044dd6ab31
Linux 4.9
Linux patch: 7.0.10

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Greybus is a Linux kernel interconnect protocol (originally from Project Ara, now in drivers/staging) that exposes module 'bundles' to userspace; the 'raw' class driver presents a bundle as a /dev character device for raw message passing. The root cause is a classic use-after-free (CWE-416): the cdev is embedded in a heap-allocated gb_raw object whose lifetime was tied to the bundle's connection rather than to outstanding file references. When the bundle disconnects, gb_raw is kfree'd immediately, but the kernel's cdev/struct file machinery still holds a reference; on close(), __fput → cdev_put dereferences the freed device, tripping the refcount_t underflow warning. The fix converts the struct device from a pointer to an embedded member, switches to cdev_device_add (which ties device lifetime to all cdev references), and moves the free into the device release function so memory is reclaimed only after the last reference drops.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local cdev access needed (AV:L, PR:L); deterministic open/disconnect/close sequence (AC:L); UAF can in principle reach full memory corruption, so C/I/A:H, though only DoS is demonstrated.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

greybus: raw: fix use-after-free on cdev close

This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):

refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130 ... Call Trace: <TASK> cdev_put+0x18/0x30 __fput+0x255/0x2a0 __x64_sys_close+0x3d/0x80 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The cdev is contained in the "gb_raw" structure, which is freed in the disconnect operation. When the cdev is released at a later time, cdev_put gets an address that points to freed memory.

To fix this use-after-free, convert the struct device from a pointer to being embedded, that makes the lifetime of the cdev and of this device the same. Then, use cdev_device_add, which guarantees that the device won't be released until all references to the cdev have been released. Finally, delegate the freeing of the structure to the device release function, instead of freeing immediately in the disconnect callback.

Executive ViewAI

Why It Matters

A use-after-free vulnerability in the Linux kernel's greybus raw driver (CVE-2026-53025, CVSS 7.8) enables local users with character-device access to trigger kernel memory corruption and system crashes when underlying hardware is disconnected. With measured exploitation likelihood of 0.2% and local-only access requirements, this primarily affects organizations using greybus-dependent hardware; most enterprise deployments face minimal real-world risk.

Business Impact: High
Compensating Controls

Patch available per vendor advisory. Interim: restrict access to greybus character device files through file system permissions or disable the greybus kernel module if not required for production operations.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Low
niche greybus raw staging driver, rarely enabled in production kernels
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53025 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373340 REF https://git.kernel.org/stable/c/0597908256173da5256ef8e6db17ccc8d5c40ee3 REF https://git.kernel.org/stable/c/3abf97a03f4abce1dc3639eea2fcd4bd747b3308 REF https://git.kernel.org/stable/c/983cc2c7efbce04ecbf6328448d895044dd6ab31 REF https://git.kernel.org/stable/c/e4d07fd4e30024a4a15094ef2c404197667c857e REF https://git.kernel.org/stable/c/e72ffe59e48a74a8d9220f5ca1d03f2194d882f0 REF https://git.kernel.org/stable/c/ef2d97c15b19b3489de01695bce478601e236c3e

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy