Executive brief
A vulnerability exists in the Linux kernel's Greybus driver, which handles communication for modular hardware. If a hardware component is disconnected while an application is still using its interface, the system may crash or experience instability. This could lead to a denial-of-service (system panic) for users of affected devices.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/staging/greybus/raw.c in the Linux kernel. The root cause is a lifetime mismatch between the 'gb_raw' structure and the character device (cdev); the structure was being freed during the disconnect operation even if an application still held an open file descriptor for the cdev. When the application later closes the cdev, the kernel attempts to access the already-freed memory, leading to a refcount underflow and system panic. The fix involves embedding the struct device within gb_raw and using cdev_device_add to ensure the memory is only released after all references are dropped.
Affected products
- Linux Linux Kernel 4.9 to 7.0.10
Timeline
- 2026-03-24: other: Patch authored
- 2026-06-24: disclosed: CVE published