Look up another CVE · open CVE-2026-53024 in the interactive tracker
CVE-2026-53024
greybus: raw: fix use-after-free if write is called after disconnect
Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem drivers/staging. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-53024 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y): BUG: kernel NULL pointer dereference, address: 0000000000000218 ... Call Trace: <TASK> gb_operation_create_common+0x61/0x180 gb_operation_create_flags+0x28/0xa0 gb_operation_sync_timeout+0x6f/0x100 raw_write+0x7b/0xc7 [gb_raw] vfs_write+0xcf/0x420 ? task_mm_cid_work+0x136/0x220 ksys_write+0x63/0xe0 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f Disconnect calls gb_connection_destroy, which ends up freeing the connection object. When gb_operation_sync is called in the write file operations, its gets a freed connection as parameter and the kernel panics. The gb_connection_destroy cannot be moved out of the disconnect function, as the Greybus subsystem expect all connections belonging to a bundle to be destroyed when disconnect returns. To prevent this bug, use a rw lock to synchronize access between write and disconnect. This guarantees that the write function doesn't try to use a disconnected connection.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/staging/greybus/raw.c
- What this is
- GREYBUS SUBSYSTEMMAINTAINERS section matched on drivers/staging/greybus/ · greybus-dev@lists.linaro.org · Maintained
- Kernel module
- none to look for. The file would have gone into gb_raw, and Debian does not compile it into that module, so finding gb_raw in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_GREYBUS|CONFIG_GREYBUS_RAW|CONFIG_STAGING' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_GREYBUS, CONFIG_GREYBUS_RAW, CONFIG_STAGING
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-24 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/staging
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.9 | 7.0.10 | 48d6c32bc049 |
| 4.9 | 7.1 | 84265cbd96b9 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached by a local `write(2)` to the Greybus raw character device, not by network packets. Although disconnect can be caused by Greybus hotplug/removal events, the crashing UAF is triggered from the local file operation.
- AC:LAttack complexity, low
- After a process keeps the raw chardev open across disconnect, a subsequent write reliably uses the destroyed `gb_connection`; no hard race or attacker-uncontrolled memory layout is required to trigger the bug. Under the conservative rule, the UAF exploitation complexity is Low.
- PR:LPrivileges required, low
- The raw driver has no capability, ioctl, or authentication checks in open/write; access is gated by ordinary permission to the created chardev. A basic local user with write access to that device can reach the vulnerable path.
- UI:NUser interaction, none
- The attacker can open the device, keep the fd, and issue the write after disconnect without requiring another user to perform an action. No victim interaction is inherent to the vulnerable syscall path.
- S:UScope, unchanged
- The impact is within the kernel/host security authority. This is not a guest-to-host, IOMMU, or separate-scope boundary crossing.
- C:HConfidentiality impact, high
- The bug is a use-after-free of `struct gb_connection`, and the stale object is dereferenced by Greybus operation creation and transport paths. As a kernel UAF, it is conservatively treated as capable of enabling kernel memory disclosure.
- I:HIntegrity impact, high
- The freed connection contains pointers used to reach host-device and driver operation paths, so heap reuse could plausibly turn the stale pointer into control-flow or write primitives. Under the required conservative UAF guidance, integrity impact is High.
- A:HAvailability impact, high
- The upstream report shows a kernel panic/NULL dereference when writing after disconnect, and UAFs can repeatedly crash the kernel. Availability impact is therefore High.