CVE-2026-53025

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53025", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.379Z", "datePublished": "2026-06-24T16:29:33.971Z", "dateUpdated": "2026-10-30T12:26:32.237Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:26:32.237Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: raw: fix use-after-free on cdev close\n\nThis addresses a use-after-free bug when a raw bundle is disconnected\nbut its chardev is still opened by an application. When the application\nreleases the cdev, it causes the following panic when init on free is\nenabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):\n\n refcount_t: underflow; use-after-free.\n WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130\n ...\n Call Trace:\n <TASK>\n cdev_put+0x18/0x30\n __fput+0x255/0x2a0\n __x64_sys_close+0x3d/0x80\n do_syscall_64+0xa4/0x290\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe cdev is contained in the \"gb_raw\" structure, which is freed in the\ndisconnect operation. When the cdev is released at a later time,\ncdev_put gets an address that points to freed memory.\n\nTo fix this use-after-free, convert the struct device from a pointer to\nbeing embedded, that makes the lifetime of the cdev and of this device\nthe same. Then, use cdev_device_add, which guarantees that the device\nwon't be released until all references to the cdev have been released.\nFinally, delegate the freeing of the structure to the device release\nfunction, instead of freeing immediately in the disconnect callback."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through a local Greybus raw character-device file descriptor, with close(2) eventually calling cdev_put on a cdev embedded in freed gb_raw memory. It is not an IP-network reachable path; Greybus disconnect/removal is the teardown condition.\nAC:L - Once a raw Greybus device exists, the sequence of opening the chardev, having the bundle disconnected, and then closing the fd deterministically triggers the stale cdev access. No narrow race win or attacker-uncontrolled memory layout condition is required to trigger the bug.\nPR:L - The raw driver performs no capability or authentication checks in its chardev operations; access is governed by the device node. Although devtmpfs defaults to root-owned 0600 absent userspace policy, the higher-severity reasonable deployment is an application-facing raw device accessible to a basic local user.\nUI:N - No separate victim action is needed when the attacker controls the local process holding and closing the file descriptor and can arrange or wait for Greybus teardown. The vulnerable access occurs during the attacker-triggered close path.\nS:U - The impact is within the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary. A kernel crash or local kernel memory corruption is standard unchanged-scope impact.\nC:H - This is a kernel heap use-after-free of a struct cdev embedded in the freed gb_raw object. Under the required kernel guidance, UAF is treated as capable of enabling high confidentiality impact through heap reuse and memory disclosure primitives.\nI:H - The stale cdev pointer is dereferenced after the containing kernel object has been freed, allowing plausible heap-spray/control-flow or object-corruption exploitation beyond a simple warning. Under the required kernel guidance, UAF maps to high integrity impact.\nA:H - The reported failure is a kernel refcount underflow/use-after-free warning and panic path during close when init-on-free is enabled. A repeatable kernel crash or oops is high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/greybus/raw.c"], "versions": [{"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "lessThan": "0597908256173da5256ef8e6db17ccc8d5c40ee3", "status": "affected", "versionType": "git"}, {"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "lessThan": "e4d07fd4e30024a4a15094ef2c404197667c857e", "status": "affected", "versionType": "git"}, {"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "lessThan": "3abf97a03f4abce1dc3639eea2fcd4bd747b3308", "status": "affected", "versionType": "git"}, {"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "lessThan": "e72ffe59e48a74a8d9220f5ca1d03f2194d882f0", "status": "affected", "versionType": "git"}, {"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "lessThan": "ef2d97c15b19b3489de01695bce478601e236c3e", "status": "affected", "versionType": "git"}, {"version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "lessThan": "983cc2c7efbce04ecbf6328448d895044dd6ab31", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/greybus/raw.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0597908256173da5256ef8e6db17ccc8d5c40ee3"}, {"url": "https://git.kernel.org/stable/c/e4d07fd4e30024a4a15094ef2c404197667c857e"}, {"url": "https://git.kernel.org/stable/c/3abf97a03f4abce1dc3639eea2fcd4bd747b3308"}, {"url": "https://git.kernel.org/stable/c/e72ffe59e48a74a8d9220f5ca1d03f2194d882f0"}, {"url": "https://git.kernel.org/stable/c/ef2d97c15b19b3489de01695bce478601e236c3e"}, {"url": "https://git.kernel.org/stable/c/983cc2c7efbce04ecbf6328448d895044dd6ab31"}], "title": "greybus: raw: fix use-after-free on cdev close", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/staging/greybus/raw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0597908256173da5256ef8e6db17ccc8d5c40ee3", "status": "affected", "version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "versionType": "git"}, {"lessThan": "e4d07fd4e30024a4a15094ef2c404197667c857e", "status": "affected", "version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "versionType": "git"}, {"lessThan": "3abf97a03f4abce1dc3639eea2fcd4bd747b3308", "status": "affected", "version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "versionType": "git"}, {"lessThan": "e72ffe59e48a74a8d9220f5ca1d03f2194d882f0", "status": "affected", "version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "versionType": "git"}, {"lessThan": "ef2d97c15b19b3489de01695bce478601e236c3e", "status": "affected", "version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "versionType": "git"}, {"lessThan": "983cc2c7efbce04ecbf6328448d895044dd6ab31", "status": "affected", "version": "e806c7fb8e9bae87fc23958c3789f2c2f96f54a4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/staging/greybus/raw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "678B0323-855A-490E-976E-4D1E35083C62", "versionEndExcluding": "7.0.10", "versionStartIncluding": "4.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: raw: fix use-after-free on cdev close\n\nThis addresses a use-after-free bug when a raw bundle is disconnected\nbut its chardev is still opened by an application. When the application\nreleases the cdev, it causes the following panic when init on free is\nenabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):\n\n refcount_t: underflow; use-after-free.\n WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130\n ...\n Call Trace:\n <TASK>\n cdev_put+0x18/0x30\n __fput+0x255/0x2a0\n __x64_sys_close+0x3d/0x80\n do_syscall_64+0xa4/0x290\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe cdev is contained in the \"gb_raw\" structure, which is freed in the\ndisconnect operation. When the cdev is released at a later time,\ncdev_put gets an address that points to freed memory.\n\nTo fix this use-after-free, convert the struct device from a pointer to\nbeing embedded, that makes the lifetime of the cdev and of this device\nthe same. Then, use cdev_device_add, which guarantees that the device\nwon't be released until all references to the cdev have been released.\nFinally, delegate the freeing of the structure to the device release\nfunction, instead of freeing immediately in the disconnect callback."}], "id": "CVE-2026-53025", "lastModified": "2026-10-30T13:19:09.023", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-24T17:17:13.857", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0597908256173da5256ef8e6db17ccc8d5c40ee3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3abf97a03f4abce1dc3639eea2fcd4bd747b3308"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/983cc2c7efbce04ecbf6328448d895044dd6ab31"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e4d07fd4e30024a4a15094ef2c404197667c857e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e72ffe59e48a74a8d9220f5ca1d03f2194d882f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef2d97c15b19b3489de01695bce478601e236c3e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: greybus: raw: fix use-after-free on cdev close", "id": "2492423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492423"}, "csaw": false, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngreybus: raw: fix use-after-free on cdev close\nThis addresses a use-after-free bug when a raw bundle is disconnected\nbut its chardev is still opened by an application. When the application\nreleases the cdev, it causes the following panic when init on free is\nenabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130\n...\nCall Trace:\n<TASK>\ncdev_put+0x18/0x30\n__fput+0x255/0x2a0\n__x64_sys_close+0x3d/0x80\ndo_syscall_64+0xa4/0x290\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nThe cdev is contained in the \"gb_raw\" structure, which is freed in the\ndisconnect operation. When the cdev is released at a later time,\ncdev_put gets an address that points to freed memory.\nTo fix this use-after-free, convert the struct device from a pointer to\nbeing embedded, that makes the lifetime of the cdev and of this device\nthe same. Then, use cdev_device_add, which guarantees that the device\nwon't be released until all references to the cdev have been released.\nFinally, delegate the freeing of the structure to the device release\nfunction, instead of freeing immediately in the disconnect callback.", "A flaw was found in the Linux kernel's Greybus raw subsystem. A local user application could trigger a use-after-free vulnerability by disconnecting a Greybus raw bundle while its associated character device was still open. When the application subsequently attempts to release the character device, it accesses freed memory, leading to a kernel panic and a system-wide Denial of Service."], "name": "CVE-2026-53025", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53025\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53025\nhttps://lore.kernel.org/linux-cve-announce/2026062453-CVE-2026-53025-ff91@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e806c7fb8e9bae87fc23958c3789f2c2f96f54a4,ef2d97c15b19b3489de01695bce478601e236c3e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e806c7fb8e9bae87fc23958c3789f2c2f96f54a4,983cc2c7efbce04ecbf6328448d895044dd6ab31)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T21:00:11.772241+00:00", "updated": "2026-08-12T06:30:17.206316+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}