Skip to main content

Linux Kernel EUVDEUVD-2026-38892

| CVE-2026-53024 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-xg88-j2c7-g852
Denial Of Service Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.7 MEDIUM

Local chardev access (AV:L, PR:L); exploitation requires winning a write/disconnect race (AC:H); demonstrated impact is a kernel panic/DoS only (A:H, C:N/I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:52 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

greybus: raw: fix use-after-free if write is called after disconnect

If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y):

BUG: kernel NULL pointer dereference, address: 0000000000000218 ... Call Trace: <TASK> gb_operation_create_common+0x61/0x180 gb_operation_create_flags+0x28/0xa0 gb_operation_sync_timeout+0x6f/0x100 raw_write+0x7b/0xc7 [gb_raw] vfs_write+0xcf/0x420 ? task_mm_cid_work+0x136/0x220 ksys_write+0x63/0xe0 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Disconnect calls gb_connection_destroy, which ends up freeing the connection object. When gb_operation_sync is called in the write file operations, its gets a freed connection as parameter and the kernel panics.

The gb_connection_destroy cannot be moved out of the disconnect function, as the Greybus subsystem expect all connections belonging to a bundle to be destroyed when disconnect returns.

To prevent this bug, use a rw lock to synchronize access between write and disconnect. This guarantees that the write function doesn't try to use a disconnected connection.

AnalysisAI

Local privilege-level denial of service in the Linux kernel's Greybus 'raw' character device driver (gb_raw) allows a user with access to the chardev to trigger a use-after-free by writing to the device after a disconnect has freed the underlying gb_connection object, causing a kernel NULL pointer dereference and panic (observed reliably with CONFIG_INIT_ON_FREE_DEFAULT_ON=y). The flaw is a race between the raw_write() path calling gb_operation_sync_timeout() and gb_connection_destroy() running during disconnect. EPSS is low (0.16%, 6th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Greybus is a Linux kernel subsystem originally developed for Project Ara that carries control and data traffic for hot-pluggable modules over a UniPro/MIPI transport, modeling devices as bundles and connections. The gb_raw driver exposes a /dev character device whose write handler builds a Greybus operation via gb_operation_create_common() and sends it synchronously through gb_operation_sync_timeout(). On module/device removal, disconnect invokes gb_connection_destroy(), which frees the connection object; the Greybus core contract requires all of a bundle's connections to be destroyed before disconnect returns, so the free cannot be deferred. The root cause is a classic use-after-free / time-of-check-to-time-of-use race (CWE-416, reported as CWE: N/A in the source data) where raw_write() dereferences a connection that disconnect has already freed. The fix introduces a reader-writer lock so writes and disconnect cannot interleave, ensuring write never operates on a torn-down connection.

RemediationAI

Patch available per vendor advisory: apply the upstream stable fixes at commits https://git.kernel.org/stable/c/84265cbd96b97058ef67e3f8be3933667a000835 and https://git.kernel.org/stable/c/48d6c32bc049abd114e8f0836c0e7d7cbfba7827, which add a reader-writer lock to serialize raw_write() against disconnect; consume them via your distribution's patched kernel package rather than hand-applying where possible (a released, tagged kernel version is not independently confirmed from the input data). If you cannot patch immediately, the most effective compensating control is to not load the gb_raw module and remove the Greybus subsystem where it is not needed (modprobe -r gb_raw / blacklist it), since this driver is rarely required outside Greybus-module hardware - trade-off: any legitimate Greybus raw users lose functionality. As a secondary control, restrict permissions on the Greybus raw /dev character device so only trusted accounts can open and write to it, reducing the local attack surface; trade-off is potential disruption to tooling that legitimately accesses the device.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38892 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy