Use-After-Free Vulnerability in Realtek USB Storage Devices by Linux Kernel

CVE-2026-90029

What is CVE-2026-90029?

A use-after-free vulnerability has been identified in the Realtek USB storage module of the Linux kernel. This issue arises when the function realtek_cr_destructor() improperly calls timer_delete() before freeing the associated chip, allowing the timer callback to potentially continue operating, which can lead to improper memory access after the memory has been freed, known as use-after-free. To address this issue, the implementation has been modified to utilize timer_shutdown_sync() to properly synchronize the callback execution, preventing further rearm events unconditionally. Moreover, the timer setup procedure has been repositioned to ensure that the timer is correctly initialized prior to any failures that could invoke the destructor, reinforcing system integrity.

References