CVE-2026-52982
published 2026-06-24CVE-2026-52982: In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.54%
41.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()
when accessing skb->len for tx statistics after usb_submit_urb() has
been called:
BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760
drivers/net/usb/rtl8150.c:712
Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226
The URB completion handler write_bulk_callback() frees the skb via
dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU
in softirq context before usb_submit_urb() returns in the submitter,
so by the time the submitter reads skb->len the skb has already been
queued to the per-CPU completion_queue and freed by net_tx_action():
CPU A (xmit) CPU B (USB completion softirq)
------------ ------------------------------
dev->tx_skb = skb;
usb_submit_urb() --+
|-------> write_bulk_callback()
| dev_kfree_skb_irq(dev->tx_skb)
| net_tx_action()
| napi_skb_cache_put() stats.tx_bytes |
+= skb->len; len before submitting the URB and using the
cached value when updating the tx_bytes counter.
The pre-existing tx_bytes semantics are preserved: the counter tracks
the original frame length (skb->len), not the ETH_ZLEN/USB-alignment
padded "count" value that is handed to the device. Changing that
would be a user-visible accounting change and is out of scope for
this UAF fix.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5af290c86fa81ddbc86a08d54229af5daa40c6a4 | 5af290c86fa81ddbc86a08d54229af5daa40c6a4 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 24831b0b2ada9fef18d1f486b7b7c444ee5ba637 | 24831b0b2ada9fef18d1f486b7b7c444ee5ba637 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 423b5b86e14e190f6e3161eb5f2ea5f908295ba7 | 423b5b86e14e190f6e3161eb5f2ea5f908295ba7 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5db090ca07b28a63fb1499690cf19a3f3adafacb | 5db090ca07b28a63fb1499690cf19a3f3adafacb |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 30cf9829d09ca958279c937af8e35495cd2f1e09 | 30cf9829d09ca958279c937af8e35495cd2f1e09 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6999d70e0eda39af029fa1891c48f0a8832b09d5 | 6999d70e0eda39af029fa1891c48f0a8832b09d5 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4dd7eb94f79486b77ca6b4c8676aedbc465dc802 | 4dd7eb94f79486b77ca6b4c8676aedbc465dc802 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 23f0e34c64acba15cad4d23e50f41f533da195fa | 23f0e34c64acba15cad4d23e50f41f533da195fa |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xm
ghsa_unreviewed·2026-06-24
CVE-2026-52982 In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xm
In the Linux kernel, the following vulnerability has been resolved:
net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()
when accessing skb->len for tx statistics after usb_submit_urb() has
been called:
BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760
drivers/net/usb/rtl8150.c:712
Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226
The URB completion handler write_bulk_callback() frees the skb via
dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU
in softirq context before usb_submit_urb() returns in the submitter,
so by the time the submitter reads skb->len the skb has already been
queued to the per-CPU completion_queue and freed by net_tx_action():
CPU A (
Red Hat
kernel: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
vendor_redhat·2026-06-24·CVSS 5.5
CVE-2026-52982 [MEDIUM] CWE-364 kernel: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
kernel: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
A flaw was found in the Linux kernel's USB network driver for Realtek RTL8150 devices. A race condition exists in the `rtl8150_start_xmit()` function, where a network packet's data buffer can be released prematurely. This can lead to a 'use-after-free' vulnerability, allowing the system to attempt to read from memory that has already been freed. Such an issue can result in system instability, crashes, or potentially the disclosure of sensitive information.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 7) - Fix deferred
Package: ke
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/23f0e34c64acba15cad4d23e50f41f533da195fahttps://git.kernel.org/stable/c/24831b0b2ada9fef18d1f486b7b7c444ee5ba637https://git.kernel.org/stable/c/30cf9829d09ca958279c937af8e35495cd2f1e09https://git.kernel.org/stable/c/423b5b86e14e190f6e3161eb5f2ea5f908295ba7https://git.kernel.org/stable/c/4dd7eb94f79486b77ca6b4c8676aedbc465dc802https://git.kernel.org/stable/c/5af290c86fa81ddbc86a08d54229af5daa40c6a4https://git.kernel.org/stable/c/5db090ca07b28a63fb1499690cf19a3f3adafacbhttps://git.kernel.org/stable/c/6999d70e0eda39af029fa1891c48f0a8832b09d5
2026-06-24
Published