Executive brief
A vulnerability was identified in the Linux kernel's driver for Realtek RTL8150 USB Ethernet adapters. Under specific timing conditions during network data transmission, the system may attempt to access memory that has already been released. This can lead to a system crash or unpredictable behavior, potentially impacting the availability of the affected device or the entire system.
Technical details
A use-after-free (UAF) read vulnerability exists in drivers/net/usb/rtl8150.c within the rtl8150_start_xmit() function. The root cause is a race condition where the sk_buff (skb) is freed by the URB completion handler (write_bulk_callback) on one CPU before the submitter on another CPU finishes accessing skb->len for statistics. An attacker with the ability to trigger network transmissions on a system using this driver could potentially trigger this race condition. The fix involves caching the skb length before submitting the URB to ensure the value is available even if the skb is freed immediately upon submission. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel up to 6.9.1
Timeline
- 2026-04-23: disclosed: Vulnerability reported by syzbot and patch authored
- 2026-04-27: patched: Mainline kernel patch committed
- 2026-06-24: advisory: CVE-2026-52982 published
References
- https://git.kernel.org/stable/c/23f0e34c64acba15cad4d23e50f41f533da195fa
- https://git.kernel.org/stable/c/24831b0b2ada9fef18d1f486b7b7c444ee5ba637
- https://git.kernel.org/stable/c/30cf9829d09ca958279c937af8e35495cd2f1e09
- https://git.kernel.org/stable/c/423b5b86e14e190f6e3161eb5f2ea5f908295ba7
- https://git.kernel.org/stable/c/4dd7eb94f79486b77ca6b4c8676aedbc465dc802
- https://git.kernel.org/stable/c/5af290c86fa81ddbc86a08d54229af5daa40c6a4
- https://git.kernel.org/stable/c/5db090ca07b28a63fb1499690cf19a3f3adafacb