|
Vulnerabilities
< Back

CVE-2026-52982

Updated on 24 Jun 2026

Severity

9.8 Critical severity

Details

CVSS score
9.8
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after usb_submit_urb() has been called:

BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760 drivers/net/usb/rtl8150.c:712 Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226

The URB completion handler write_bulk_callback() frees the skb via dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU in softirq context before usb_submit_urb() returns in the submitter, so by the time the submitter reads skb->len the skb has already been queued to the per-CPU completion_queue and freed by net_tx_action():

CPU A (xmit) CPU B (USB completion softirq)

dev->tx_skb = skb; usb_submit_urb() –+ |——-> write_bulk_callback() | dev_kfree_skb_irq(dev->tx_skb) | net_tx_action() | napi_skb_cache_put() <– free netdev->stats.tx_bytes | += skb->len; <– UAF read

Fix it by caching skb->len before submitting the URB and using the cached value when updating the tx_bytes counter.

The pre-existing tx_bytes semantics are preserved: the counter tracks the original frame length (skb->len), not the ETH_ZLEN/USB-alignment padded “count” value that is handed to the device. Changing that would be a user-visible accounting change and is out of scope for this UAF fix.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 6 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 7 ELS , Debian 10 ELS , Oracle Linux 6 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:
linux @ 4.19.0 (+18 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 11 Released
37 kernels
  • 5.10.46-5
  • 5.10.70-1
  • 5.10.46-4
  • 5.10.84-1
  • 5.10.92-1
  • 5.10.92-2
  • 5.10.103-1
  • 5.10.106-1
  • 5.10.113-1
  • 5.10.120-1
  • 5.10.127-1
  • 5.10.127-2
  • 5.10.136-1
  • 5.10.140-1
  • 5.10.149-1
  • 5.10.149-2
  • 5.10.158-2
  • 5.10.162-1
  • 5.10.179-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.178-3
  • 5.10.205-2
  • 5.10.205-1
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 11 cloud Released
17 kernels
  • 5.10.113-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.205-2
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 12 Released
40 kernels
  • 6.1.38-1
  • 6.1.38-2
  • 6.1.38-4
  • 6.1.52-1
  • 6.1.55-1
  • 6.1.64-1
  • 6.1.66-1
  • 6.1.69-1
  • 6.1.76-1
  • 6.1.27-1
  • 6.1.67-1
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
  • 6.1.133-1
  • 6.1.135-1
  • 6.1.137-1
  • 6.1.140-1
  • 6.1.139-1
  • 6.1.147-1
  • 6.1.148-1
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
  • 6.1.164-1
  • 6.1.170-1
  • 6.1.170-3
  • 6.1.172-1
  • 6.1.174-1
  • 6.1.170-2
Debian 13 Released
10 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.74-2
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.69-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
Proxmox VE 7 5.15 Released
47 kernels
  • 5.15.5-1-pve-5.15.5-1
  • 5.15.12-1-pve-5.15.12-2
  • 5.15.12-1-pve-5.15.12-3
  • 5.15.17-1-pve-5.15.17-1
  • 5.15.19-1-pve-5.15.19-1
  • 5.15.19-2-pve-5.15.19-2
  • 5.15.19-2-pve-5.15.19-3
  • 5.15.27-1-pve-5.15.27-1
  • 5.15.30-1-pve-5.15.30-1
  • 5.15.30-2-pve-5.15.30-3
  • 5.15.35-1-pve-5.15.35-1
  • 5.15.35-1-pve-5.15.35-2
  • 5.15.35-1-pve-5.15.35-3
  • 5.15.35-2-pve-5.15.35-4
  • 5.15.35-2-pve-5.15.35-5
  • 5.15.35-3-pve-5.15.35-6
  • 5.15.39-1-pve-5.15.39-1
  • 5.15.39-2-pve-5.15.39-2
  • 5.15.39-3-pve-5.15.39-3
  • 5.15.39-4-pve-5.15.39-4
  • 5.15.7-1-pve-5.15.7-1
  • 5.15.53-1-pve-5.15.53-1
  • 5.15.60-1-pve-5.15.60-1
  • 5.15.60-2-pve-5.15.60-2
  • 5.15.64-1-pve-5.15.64-1
  • 5.15.74-1-pve-5.15.74-1
  • 5.15.83-1-pve-5.15.83-1
  • 5.15.102-1-pve-5.15.102-1
  • 5.15.104-1-pve-5.15.104-1
  • 5.15.104-1-pve-5.15.104-2
  • 5.15.107-1-pve-5.15.107-1
  • 5.15.107-2-pve-5.15.107-2
  • 5.15.85-1-pve-5.15.85-1
  • 5.15.108-1-pve-5.15.108-1
  • 5.15.108-1-pve-5.15.108-2
  • 5.15.116-1-pve-5.15.116-1
  • 5.15.126-1-pve-5.15.126-1
  • 5.15.131-1-pve-5.15.131-1
  • 5.15.131-1-pve-5.15.131-2
  • 5.15.131-2-pve-5.15.131-3
  • 5.15.136-1-pve-5.15.136-1
  • 5.15.111-1-pve-5.15.111-1
  • 5.15.143-1-pve-5.15.143-1
  • 5.15.149-1-pve-5.15.149-1
  • 5.15.152-1-pve-5.15.152-1
  • 5.15.158-1-pve_5.15.158-1
  • 5.15.158-2-pve_5.15.158-2
Ubuntu 18.04 Planned —
Ubuntu 20.04 Planned —
Ubuntu 20.04 HWE AWS Released
57 kernels
  • 5.15.0-1026.30~20.04.2
  • 5.15.0-1022.26~20.04.1
  • 5.15.0-1023.27~20.04.1
  • 5.15.0-1021.25~20.04.1
  • 5.15.0-1020.24~20.04.1
  • 5.15.0-1017.21~20.04.1
  • 5.15.0-1019.23~20.04.1
  • 5.15.0-1014.18~20.04.1
  • 5.15.0-1015.19~20.04.1
  • 5.15.0-1018.22~20.04.1
  • 5.15.0-1027.31~20.04.1
  • 5.15.0-1028.32~20.04.1
  • 5.15.0-1030.34~20.04.1
  • 5.15.0-1031.35~20.04.1
  • 5.15.0-1033.37~20.04.1
  • 5.15.0-1034.38~20.04.1
  • 5.15.0-1035.39~20.04.1
  • 5.15.0-1036.40~20.04.1
  • 5.15.0-1037.41~20.04.1
  • 5.15.0-1038.43~20.04.1
  • 5.15.0-1039.44~20.04.1
  • 5.15.0-1040.45~20.04.1
  • 5.15.0-1041.46~20.04.1
  • 5.15.0-1043.48~20.04.1
  • 5.15.0-1044.49~20.04.1
  • 5.15.0-1045.50~20.04.1
  • 5.15.0-1047.52~20.04.1
  • 5.15.0-1048.53~20.04.1
  • 5.15.0-1049.54~20.04.1
  • 5.15.0-1050.55~20.04.1
  • 5.15.0-1051.56~20.04.1
  • 5.15.0-1052.57~20.04.1
  • 5.15.0-1053.58~20.04.1
  • 5.15.0-1055.60~20.04.1
  • 5.15.0-1056.61~20.04.1
  • 5.15.0-1057.63~20.04.1
  • 5.15.0-1058.64~20.04.1
  • 5.15.0-1061.67~20.04.1
  • 5.15.0-1062.68~20.04.1
  • 5.15.0-1063.69~20.04.1
  • 5.15.0-1064.70~20.04.1
  • 5.15.0-1065.71~20.04.1
  • 5.15.0-1066.72~20.04.1
  • 5.15.0-1067.73~20.04.1
  • 5.15.0-1068.74~20.04.1
  • 5.15.0-1069.75~20.04.1
  • 5.15.0-1070.76~20.04.1
  • 5.15.0-1071.77~20.04.1
  • 5.15.0-1072.78~20.04.1
  • 5.15.0-1073.79~20.04.1
  • 5.15.0-1075.82~20.04.1
  • 5.15.0-1077.84~20.04.1
  • 5.15.0-1080.87~20.04.1
  • 5.15.0-1081.88~20.04.1
  • 5.15.0-1082.89~20.04.1
  • 5.15.0-1083.90~20.04.1
  • 5.15.0-1084.91~20.04.1
Ubuntu 20.04 HWE Azure Released
40 kernels
  • 5.15.0-1029.36~20.04.1
  • 5.15.0-1022.27~20.04.1
  • 5.15.0-1023.29~20.04.1
  • 5.15.0-1021.26~20.04.1
  • 5.15.0-1020.25~20.04.1
  • 5.15.0-1017.20~20.04.1
  • 5.15.0-1019.24~20.04.1
  • 5.15.0-1008.9~20.04.1
  • 5.15.0-1013.16~20.04.1
  • 5.15.0-1014.17~20.04.1
  • 5.15.0-1024.30~20.04.1
  • 5.15.0-1034.41~20.04.1
  • 5.15.0-1049.56~20.04.1
  • 5.15.0-1050.57~20.04.1
  • 5.15.0-1054.62~20.04.1
  • 5.15.0-1056.64~20.04.1
  • 5.15.0-1057.65~20.04.1
  • 5.15.0-1058.66~20.04.2
  • 5.15.0-1059.67~20.04.1
  • 5.15.0-1060.69~20.04.1
  • 5.15.0-1061.70~20.04.1
  • 5.15.0-1063.72~20.04.1
  • 5.15.0-1064.73~20.04.1
  • 5.15.0-1067.76~20.04.1
  • 5.15.0-1068.77~20.04.1
  • 5.15.0-1065.74~20.04.1
  • 5.15.0-1070.79~20.04.1
  • 5.15.0-1071.80~20.04.1
  • 5.15.0-1072.81~20.04.1
  • 5.15.0-1073.82~20.04.1
  • 5.15.0-1074.83~20.04.1
  • 5.15.0-1075.84~20.04.1
  • 5.15.0-1078.87~20.04.1
  • 5.15.0-1079.88~20.04.1
  • 5.15.0-1081.90~20.04.1
  • 5.15.0-1082.91~20.04.1
  • 5.15.0-1086.95~20.04.1
  • 5.15.0-1087.96~20.04.1
  • 5.15.0-1088.97~20.04.1
  • 5.15.0-1089.98~20.04.1
Ubuntu 22.04 Released
97 kernels
  • 5.15.0-27.28
  • 5.15.0-33.34
  • 5.15.0-37.39
  • 5.15.0-39.42
  • 5.15.0-25.25
  • 5.15.0-28.29
  • 5.15.0-29.30
  • 5.15.0-30.31
  • 5.15.0-41.44
  • 5.15.0-43.46
  • 5.15.0-46.49
  • 5.15.0-35.36
  • 5.15.0-47.51
  • 5.15.0-48.54
  • 5.15.0-40.43
  • 5.15.0-50.56
  • 5.15.0-52.58
  • 5.15.0-53.59
  • 5.15.0-56.62
  • 5.15.0-54.60
  • 5.15.0-57.63
  • 5.15.0-58.64
  • 5.15.0-60.66
  • 5.15.0-67.74
  • 5.15.0-69.76
  • 5.15.0-70.77
  • 5.15.0-71.78
  • 5.15.0-72.79
  • 5.15.0-68.75
  • 5.15.0-73.80
  • 5.15.0-75.82
  • 5.15.0-76.83
  • 5.15.0-78.85
  • 5.15.0-79.86
  • 5.15.0-82.91
  • 5.15.0-83.92
  • 5.15.0-84.93
  • 5.15.0-86.96
  • 5.15.0-74.81
  • 5.15.0-87.97
  • 5.15.0-88.98
  • 5.15.0-89.99
  • 5.15.0-91.101
  • 5.15.0-92.102
  • 5.15.0-94.104
  • 5.15.0-97.107
  • 5.15.0-100.110
  • 5.15.0-101.111
  • 5.15.0-102.112
  • 5.15.0-105.115
  • 5.15.0-106.116
  • 5.15.0-107.117
  • 5.15.0-112.122
  • 5.15.0-113.123
  • 5.15.0-116.126
  • 5.15.0-117.127
  • 5.15.0-118.128
  • 5.15.0-119.129
  • 5.15.0-121.131
  • 5.15.0-122.132
  • 5.15.0-124.134
  • 5.15.0-125.135
  • 5.15.0-127.137
  • 5.15.0-130.140
  • 5.15.0-126.136
  • 5.15.0-131.141
  • 5.15.0-128.138
  • 5.15.0-133.144
  • 5.15.0-134.145
  • 5.15.0-135.146
  • 5.15.0-136.147
  • 5.15.0-138.148
  • 5.15.0-139.149
  • 5.15.0-140.150
  • 5.15.0-141.151
  • 5.15.0-142.152
  • 5.15.0-143.153
  • 5.15.0-144.157
  • 5.15.0-151.161
  • 5.15.0-152.162
  • 5.15.0-153.163
  • 5.15.0-156.166
  • 5.15.0-157.167
  • 5.15.0-160.170
  • 5.15.0-161.171
  • 5.15.0-163.173
  • 5.15.0-164.174
  • 5.15.0-168.178
  • 5.15.0-170.180
  • 5.15.0-171.181
  • 5.15.0-173.183
  • 5.15.0-174.184
  • 5.15.0-176.186
  • 5.15.0-177.187
  • 5.15.0-179.189
  • 5.15.0-181.191
  • 5.15.0-185.195
Ubuntu 22.04 AWS Released
88 kernels
  • 5.15.0-1005.7
  • 5.15.0-1008.10
  • 5.15.0-1011.14
  • 5.15.0-1013.17
  • 5.15.0-1015.19
  • 5.15.0-1017.21
  • 5.15.0-1009.11
  • 5.15.0-1020.24
  • 5.15.0-1021.25
  • 5.15.0-1022.26
  • 5.15.0-1023.27
  • 5.15.0-1026.30
  • 5.15.0-1004.6
  • 5.15.0-1014.18
  • 5.15.0-1018.22
  • 5.15.0-1024.29
  • 5.15.0-1027.31
  • 5.15.0-1028.32
  • 5.15.0-1030.34
  • 5.15.0-1031.35
  • 5.15.0-1033.37
  • 5.15.0-1034.38
  • 5.15.0-1035.39
  • 5.15.0-1036.40
  • 5.15.0-1032.36
  • 5.15.0-1037.41
  • 5.15.0-1038.43
  • 5.15.0-1039.44
  • 5.15.0-1040.45
  • 5.15.0-1042.47
  • 5.15.0-1043.48
  • 5.15.0-1044.49
  • 5.15.0-1045.50
  • 5.15.0-1047.52
  • 5.15.0-1048.53
  • 5.15.0-1049.54
  • 5.15.0-1050.55
  • 5.15.0-1051.56
  • 5.15.0-1052.57
  • 5.15.0-1053.58
  • 5.15.0-1055.60
  • 5.15.0-1056.61
  • 5.15.0-1057.63
  • 5.15.0-1060.66
  • 5.15.0-1061.67
  • 5.15.0-1062.68
  • 5.15.0-1063.69
  • 5.15.0-1064.70
  • 5.15.0-1065.71
  • 5.15.0-1066.72
  • 5.15.0-1067.73
  • 5.15.0-1068.74
  • 5.15.0-1069.75
  • 5.15.0-1070.76
  • 5.15.0-1071.77
  • 5.15.0-1072.78
  • 5.15.0-1073.79
  • 5.15.0-1076.83
  • 5.15.0-1078.85
  • 5.15.0-1079.86
  • 5.15.0-1080.87
  • 5.15.0-1081.88
  • 5.15.0-1082.89
  • 5.15.0-1083.90
  • 5.15.0-1084.91
  • 5.15.0-1085.92
  • 5.15.0-1086.93
  • 5.15.0-1087.94
  • 5.15.0-1088.95
  • 5.15.0-1089.96
  • 5.15.0-1090.97
  • 5.15.0-1091.98
  • 5.15.0-1092.99
  • 5.15.0-1093.100
  • 5.15.0-1095.102
  • 5.15.0-1096.103
  • 5.15.0-1097.104
  • 5.15.0-1098.105
  • 5.15.0-1099.106
  • 5.15.0-1100.107
  • 5.15.0-1101.108
  • 5.15.0-1103.110
  • 5.15.0-1104.111
  • 5.15.0-1105.112
  • 5.15.0-1106.113
  • 5.15.0-1108.115
  • 5.15.0-1109.116
  • 5.15.0-1111.118
Ubuntu 22.04 Azure Released
78 kernels
  • 5.15.0-1005.6
  • 5.15.0-1007.8
  • 5.15.0-1010.12
  • 5.15.0-1012.15
  • 5.15.0-1014.17
  • 5.15.0-1017.20
  • 5.15.0-1008.9
  • 5.15.0-1019.24
  • 5.15.0-1020.25
  • 5.15.0-1021.26
  • 5.15.0-1022.27
  • 5.15.0-1003.4
  • 5.15.0-1013.16
  • 5.15.0-1023.29
  • 5.15.0-1029.36
  • 5.15.0-1024.30
  • 5.15.0-1034.41
  • 5.15.0-1035.42
  • 5.15.0-1036.43
  • 5.15.0-1037.44
  • 5.15.0-1038.45
  • 5.15.0-1039.46
  • 5.15.0-1040.47
  • 5.15.0-1041.48
  • 5.15.0-1042.49
  • 5.15.0-1045.52
  • 5.15.0-1046.53
  • 5.15.0-1047.54
  • 5.15.0-1049.56
  • 5.15.0-1044.51
  • 5.15.0-1050.57
  • 5.15.0-1051.59
  • 5.15.0-1052.60
  • 5.15.0-1053.61
  • 5.15.0-1054.62
  • 5.15.0-1056.64
  • 5.15.0-1057.65
  • 5.15.0-1058.66
  • 5.15.0-1059.67
  • 5.15.0-1060.69
  • 5.15.0-1061.70
  • 5.15.0-1063.72
  • 5.15.0-1064.73
  • 5.15.0-1066.75
  • 5.15.0-1067.76
  • 5.15.0-1068.77
  • 5.15.0-1070.79
  • 5.15.0-1071.80
  • 5.15.0-1072.81
  • 5.15.0-1073.82
  • 5.15.0-1074.83
  • 5.15.0-1075.84
  • 5.15.0-1078.87
  • 5.15.0-1079.88
  • 5.15.0-1081.90
  • 5.15.0-1082.91
  • 5.15.0-1084.93
  • 5.15.0-1086.95
  • 5.15.0-1087.96
  • 5.15.0-1088.97
  • 5.15.0-1089.98
  • 5.15.0-1090.99
  • 5.15.0-1091.100
  • 5.15.0-1092.101
  • 5.15.0-1094.103
  • 5.15.0-1095.104
  • 5.15.0-1096.105
  • 5.15.0-1097.106
  • 5.15.0-1098.107
  • 5.15.0-1101.110
  • 5.15.0-1102.111
  • 5.15.0-1099.108
  • 5.15.0-1103.112
  • 5.15.0-1109.118
  • 5.15.0-1110.119
  • 5.15.0-1111.120
  • 5.15.0-1114.123
  • 5.15.0-1116.125
Ubuntu 24.04 Released
46 kernels
  • 6.8.0-35.35
  • 6.8.0-38.38
  • 6.8.0-36.36
  • 6.8.0-39.39
  • 6.8.0-40.40
  • 6.8.0-41.41
  • 6.8.0-44.44
  • 6.8.0-45.45
  • 6.8.0-31.31
  • 6.8.0-47.47
  • 6.8.0-48.48
  • 6.8.0-49.49
  • 6.8.0-50.51
  • 6.8.0-51.52
  • 6.8.0-52.53
  • 6.8.0-54.56
  • 6.8.0-55.57
  • 6.8.0-53.55
  • 6.8.0-56.58
  • 6.8.0-57.59
  • 6.8.0-58.60
  • 6.8.0-59.61
  • 6.8.0-60.63
  • 6.8.0-62.65
  • 6.8.0-63.66
  • 6.8.0-64.67
  • 6.8.0-71.71
  • 6.8.0-78.78
  • 6.8.0-79.79
  • 6.8.0-84.84
  • 6.8.0-85.85
  • 6.8.0-83.83
  • 6.8.0-86.87
  • 6.8.0-87.88
  • 6.8.0-88.89
  • 6.8.0-90.91
  • 6.8.0-94.96
  • 6.8.0-100.100
  • 6.8.0-101.101
  • 6.8.0-106.106
  • 6.8.0-107.107
  • 6.8.0-110.110
  • 6.8.0-111.111
  • 6.8.0-117.117
  • 6.8.0-124.124
  • 6.8.0-134.134