Executive brief
The Linux kernel's Realtek USB card reader driver (realtek_cr) contains a use-after-free vulnerability in its device disconnect handler. When a Realtek card reader is disconnected, a kernel timer can trigger after the device's memory has been freed, potentially leading to system crashes or memory corruption. The vulnerability affects systems using Realtek card reader devices.
Technical details
This is a use-after-free vulnerability in the realtek_cr USB storage driver (drivers/usb/storage/realtek_cr.c). The root cause is that realtek_cr_destructor() calls timer_delete() before freeing the chip structure, but the timer callback (rts51x_suspend_timer_fn) can still be running and may rearm itself, leading to access of freed memory. The fix replaces timer_delete() with timer_shutdown_sync() to properly wait for any running callback and prevent rearming, and moves timer_setup() to init_realtek_cr() to ensure proper initialization before any error path. The vulnerability is exploitable via device disconnect without requiring special authentication or user interaction. Patches are available in Linux stable tree versions.
Affected products
- Linux Linux kernel multiple versions (see git.kernel.org stable tree)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-09-01: patched: Fix committed upstream (4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc)
- 2026-07-27: other: Original patch author timestamp