Skip to main content

Linux Kernel EUVDEUVD-2026-38893

| CVE-2026-53025 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-4c74-g9cq-vhc5
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local cdev access needed (AV:L, PR:L); deterministic open/disconnect/close sequence (AC:L); UAF can in principle reach full memory corruption, so C/I/A:H, though only DoS is demonstrated.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:52 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

greybus: raw: fix use-after-free on cdev close

This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):

refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130 ... Call Trace: <TASK> cdev_put+0x18/0x30 __fput+0x255/0x2a0 __x64_sys_close+0x3d/0x80 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The cdev is contained in the "gb_raw" structure, which is freed in the disconnect operation. When the cdev is released at a later time, cdev_put gets an address that points to freed memory.

To fix this use-after-free, convert the struct device from a pointer to being embedded, that makes the lifetime of the cdev and of this device the same. Then, use cdev_device_add, which guarantees that the device won't be released until all references to the cdev have been released. Finally, delegate the freeing of the structure to the device release function, instead of freeing immediately in the disconnect callback.

AnalysisAI

Use-after-free in the Linux kernel's greybus 'raw' driver (drivers/staging/greybus/raw.c) allows a local user holding an open character-device handle to trigger memory corruption when the underlying raw bundle is disconnected and the application later closes the cdev. The flaw stems from the gb_raw structure (which embeds the cdev) being freed in the disconnect callback while a userspace reference remains, causing cdev_put to operate on freed memory and a refcount underflow/panic, especially with CONFIG_INIT_ON_FREE_DEFAULT_ON=y. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), consistent with a local, niche-driver issue.

Technical ContextAI

Greybus is a Linux kernel interconnect protocol (originally from Project Ara, now in drivers/staging) that exposes module 'bundles' to userspace; the 'raw' class driver presents a bundle as a /dev character device for raw message passing. The root cause is a classic use-after-free (CWE-416): the cdev is embedded in a heap-allocated gb_raw object whose lifetime was tied to the bundle's connection rather than to outstanding file references. When the bundle disconnects, gb_raw is kfree'd immediately, but the kernel's cdev/struct file machinery still holds a reference; on close(), __fput → cdev_put dereferences the freed device, tripping the refcount_t underflow warning. The fix converts the struct device from a pointer to an embedded member, switches to cdev_device_add (which ties device lifetime to all cdev references), and moves the free into the device release function so memory is reclaimed only after the last reference drops.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply a kernel build that includes stable commits ef2d97c15b19b3489de01695bce478601e236c3e and 983cc2c7efbce04ecbf6328448d895044dd6ab31 (corresponding to stable lines reported as 7.0.10 and 7.1 in EUVD), available via https://git.kernel.org/stable/c/ef2d97c15b19b3489de01695bce478601e236c3e and https://git.kernel.org/stable/c/983cc2c7efbce04ecbf6328448d895044dd6ab31. Because greybus is staging code, the most effective compensating control where the fix cannot be deployed is to not build or load the driver: ensure CONFIG_GREYBUS_RAW is unset, or blacklist/unload the gb_raw module (modprobe -r gb_raw and add to /etc/modprobe.d blacklist), which fully removes the attack surface at the cost of losing greybus raw functionality. If the driver must remain loaded, restrict permissions on the greybus raw /dev character device so only trusted accounts can open it, reducing which local users can reach the vulnerable close() path; note this does not fix the underlying UAF and only narrows exposure.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38893 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy