CVE-2026-45978: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45978 Overview

CVE-2026-45978 is a NULL pointer dereference vulnerability in the Linux kernel's Greybus lights staging driver. The flaw resides in the gb_lights_light_config() function, which stored channel_count before allocating the corresponding channels array. When kcalloc() fails to allocate memory, the subsequent cleanup path in gb_lights_release() iterates over the non-zero count and dereferences light->channels, which remains NULL. The resolved fix reorders the operations so that channels are allocated first and channels_count is only published after a successful allocation, preventing the cleanup path from walking a NULL pointer.

Critical Impact
A failed memory allocation during Greybus lights configuration triggers a kernel NULL pointer dereference, leading to a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel staging/greybus/lights driver
Linux stable kernel branches referenced in upstream commits 01b91cb, 06162d8, 3cbe694, 65f2c60, a118724, ba50221, da46264, and efcffd9
Systems using Greybus subsystem for lighting peripherals

Discovery Timeline

2026-05-27 - CVE-2026-45978 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45978

Vulnerability Analysis

The vulnerability is a classic NULL pointer dereference triggered by a memory allocation failure path. In gb_lights_light_config(), the driver assigned channels_count to the light structure before invoking kcalloc() to allocate the channels array. When allocation pressure or contrived conditions cause kcalloc() to return NULL, the function returns an error. The cleanup routine, gb_lights_release(), then trusts channels_count as a loop bound and walks the light->channels pointer to release per-channel resources. Because the array was never allocated, this access faults inside kernel context.

The practical impact is a kernel oops or panic, depending on kernel configuration. Systems running Greybus-attached peripherals, such as certain mobile and embedded devices, are within scope. The fix repositions the allocation before the count assignment, ensuring the cleanup invariant holds.

Root Cause

The root cause is an ordering violation between state publication and resource allocation. The driver published the channels_count field before the backing storage existed, breaking the implicit contract relied on by the release path.

Attack Vector

Exploitation requires conditions that induce kcalloc() failure during Greybus light configuration. This is typically a local denial-of-service scenario rather than a remote attack. An attacker with the ability to attach Greybus devices or stress kernel memory allocation can reliably trigger the fault.

// No verified exploitation code is available for this issue.
// The vulnerability manifests when kcalloc() returns NULL after
// channels_count has already been assigned, causing gb_lights_release()
// to dereference a NULL light->channels pointer during cleanup.

Detection Methods for CVE-2026-45978

Indicators of Compromise

Kernel oops or panic messages referencing gb_lights_release or gb_lights_light_config in dmesg and /var/log/kern.log
Stack traces showing NULL pointer dereference within the drivers/staging/greybus/lights.c code path
Unexpected reboots or service interruptions on systems using Greybus light peripherals

Detection Strategies

Monitor kernel logs for BUG: kernel NULL pointer dereference entries correlated with Greybus module activity
Audit running kernel versions against the patched commits listed in upstream stable branches
Track memory pressure events that coincide with Greybus device hotplug or configuration

Monitoring Recommendations

Centralize kernel ring buffer collection from Linux endpoints to detect crash signatures
Alert on repeated kernel oops events associated with staging drivers
Inventory devices that load the gb_lights module to scope exposure

How to Mitigate CVE-2026-45978

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 01b91cb3e748, 06162d85f830, 3cbe694d235d, 65f2c608096d, a118724d7641, ba5022162da6, da46264a7016, and efcffd9a6ad8
Update to a stable Linux kernel release that includes the fix on each affected branch
Restrict load of the gb_lights staging module on systems that do not require Greybus lighting support

Patch Information

The fix reorders allocation and assignment within gb_lights_light_config() so that kcalloc() succeeds before channels_count is published to the light structure. This ensures gb_lights_release() cannot walk a NULL light->channels pointer. Patches are available in the upstream stable trees via Kernel Git Commit 01b91cb, Kernel Git Commit 06162d8, Kernel Git Commit 3cbe694, Kernel Git Commit 65f2c60, Kernel Git Commit a118724, Kernel Git Commit ba50221, Kernel Git Commit da46264, and Kernel Git Commit efcffd9.

Workarounds

Blacklist the gb_lights module on systems that do not use Greybus lighting peripherals
Limit local user access on devices where the Greybus subsystem is enabled
Reduce conditions that induce kernel allocation failure by ensuring sufficient available memory on embedded targets

bash

# Blacklist the Greybus lights staging module
echo "blacklist gb_lights" | sudo tee /etc/modprobe.d/blacklist-gb-lights.conf
sudo update-initramfs -u