Look up another CVE · open CVE-2026-53025 in the interactive tracker
CVE-2026-53025
greybus: raw: fix use-after-free on cdev close
Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem drivers/staging. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-53025 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y): refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130 ... Call Trace: <TASK> cdev_put+0x18/0x30 __fput+0x255/0x2a0 __x64_sys_close+0x3d/0x80 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f The cdev is contained in the "gb_raw" structure, which is freed in the disconnect operation. When the cdev is released at a later time, cdev_put gets an address that points to freed memory. To fix this use-after-free, convert the struct device from a pointer to being embedded, that makes the lifetime of the cdev and of this device the same. Then, use cdev_device_add, which guarantees that the device won't be released until all references to the cdev have been released. Finally, delegate the freeing of the structure to the device release function, instead of freeing immediately in the disconnect callback.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/staging/greybus/raw.c
- What this is
- GREYBUS SUBSYSTEMMAINTAINERS section matched on drivers/staging/greybus/ · greybus-dev@lists.linaro.org · Maintained
- Kernel module
- none to look for. The file would have gone into gb_raw, and Debian does not compile it into that module, so finding gb_raw in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_GREYBUS|CONFIG_GREYBUS_RAW|CONFIG_STAGING' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_GREYBUS, CONFIG_GREYBUS_RAW, CONFIG_STAGING
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-24 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/staging
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.9 | 6.18.57 | e72ffe59e48a |
| 4.9 | 7.0.10 | ef2d97c15b19 |
| 4.9 | 7.1 | 983cc2c7efbc |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached through a local Greybus raw character-device file descriptor, with close(2) eventually calling cdev_put on a cdev embedded in freed gb_raw memory. It is not an IP-network reachable path; Greybus disconnect/removal is the teardown condition.
- AC:LAttack complexity, low
- Once a raw Greybus device exists, the sequence of opening the chardev, having the bundle disconnected, and then closing the fd deterministically triggers the stale cdev access. No narrow race win or attacker-uncontrolled memory layout condition is required to trigger the bug.
- PR:LPrivileges required, low
- The raw driver performs no capability or authentication checks in its chardev operations; access is governed by the device node. Although devtmpfs defaults to root-owned 0600 absent userspace policy, the higher-severity reasonable deployment is an application-facing raw device accessible to a basic local user.
- UI:NUser interaction, none
- No separate victim action is needed when the attacker controls the local process holding and closing the file descriptor and can arrange or wait for Greybus teardown. The vulnerable access occurs during the attacker-triggered close path.
- S:UScope, unchanged
- The impact is within the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary. A kernel crash or local kernel memory corruption is standard unchanged-scope impact.
- C:HConfidentiality impact, high
- This is a kernel heap use-after-free of a struct cdev embedded in the freed gb_raw object. Under the required kernel guidance, UAF is treated as capable of enabling high confidentiality impact through heap reuse and memory disclosure primitives.
- I:HIntegrity impact, high
- The stale cdev pointer is dereferenced after the containing kernel object has been freed, allowing plausible heap-spray/control-flow or object-corruption exploitation beyond a simple warning. Under the required kernel guidance, UAF maps to high integrity impact.
- A:HAvailability impact, high
- The reported failure is a kernel refcount underflow/use-after-free warning and panic path during close when init-on-free is enabled. A repeatable kernel crash or oops is high availability impact.