CVE-2026-52982: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52982 Overview

CVE-2026-52982 is a use-after-free vulnerability in the Linux kernel's rtl8150 USB Ethernet driver. The flaw resides in the rtl8150_start_xmit() transmit path in drivers/net/usb/rtl8150.c. Syzbot reported the issue as a KASAN slab-use-after-free read when the driver accessed skb->len for TX statistics after calling usb_submit_urb(). The URB completion handler write_bulk_callback() can free the socket buffer in softirq context on another CPU before the submitter reads skb->len, producing a race condition that corrupts memory accounting and risks kernel instability.

Critical Impact
A local condition in the Linux kernel network stack can trigger a use-after-free read on socket buffer memory, which may cause kernel memory corruption or denial of service on systems using the rtl8150 USB Ethernet adapter.

Affected Products

Linux kernel versions containing the vulnerable rtl8150 driver in drivers/net/usb/rtl8150.c
Systems using Realtek RTL8150 USB 10/100 Ethernet adapters
Distributions shipping affected stable kernel branches prior to the referenced patch commits

Discovery Timeline

2026-06-24 - CVE-2026-52982 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52982

Vulnerability Analysis

The vulnerability is a Use-After-Free in the transmit path of the rtl8150 USB Ethernet driver. In rtl8150_start_xmit(), the driver assigns the outgoing socket buffer to dev->tx_skb, calls usb_submit_urb(), and then reads skb->len to update netdev->stats.tx_bytes. USB URBs can complete asynchronously in softirq context on a different CPU. When the URB completes before the submitter reads skb->len, the completion handler write_bulk_callback() invokes dev_kfree_skb_irq(dev->tx_skb). The socket buffer is then queued to the per-CPU completion_queue and freed by net_tx_action() via napi_skb_cache_put(). The submitter's subsequent dereference of skb->len accesses freed slab memory.

Root Cause

The root cause is a lifetime management error between the URB submission path and the URB completion callback. The driver retains a pointer-derived reference to the skb after handing ownership to the USB subsystem. There is no synchronization guaranteeing the skb remains valid after usb_submit_urb() returns, so any post-submission access races with completion-time frees.

Attack Vector

The race is triggerable on systems using the rtl8150 USB Ethernet adapter when network traffic is transmitted. Syzbot reproduced the condition under fuzzing using KASAN instrumentation. The fix caches skb->len into a local variable before usb_submit_urb() is called, and the cached value is used when updating the tx_bytes counter. This preserves pre-existing accounting semantics, where the counter tracks the original frame length rather than the padded count value passed to the device. For technical details, see the upstream patch commits, including kernel patch 23f0e34c64ac and kernel patch 6999d70e0eda.

Detection Methods for CVE-2026-52982

Indicators of Compromise

KASAN reports referencing slab-use-after-free in rtl8150_start_xmit in kernel logs (dmesg or journalctl -k)
Unexpected kernel oops, panics, or memory corruption messages on hosts using Realtek RTL8150 USB Ethernet adapters
Anomalous values in netdev->stats.tx_bytes for the affected network interface

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free reads in the rtl8150 driver
Audit running kernel versions across the fleet and compare against the stable patch commits referenced in this advisory
Monitor kernel ring buffer logs for crash signatures originating in drivers/net/usb/rtl8150.c

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on KASAN, BUG, or Oops messages tied to USB network drivers
Track kernel package versions on endpoints and servers to confirm patched builds are deployed
Inventory hosts containing RTL8150-based USB Ethernet adapters and prioritize them for patch verification

How to Mitigate CVE-2026-52982

Immediate Actions Required

Apply the upstream Linux kernel stable patches that cache skb->len before the call to usb_submit_urb() in rtl8150_start_xmit()
Update to a distribution kernel that includes the referenced stable commits and reboot affected systems
On systems where the rtl8150 driver is not required, unload the module with modprobe -r rtl8150 to remove exposure

Patch Information

The fix is available across multiple stable kernel branches. Relevant upstream commits include 23f0e34c64ac, 24831b0b2ada, 30cf9829d09c, 423b5b86e14e, 4dd7eb94f794, 5af290c86fa8, 5db090ca07b2, and 6999d70e0eda. The patch caches skb->len in a local variable prior to URB submission and uses the cached value when updating the tx_bytes counter.

Workarounds

Blocklist the rtl8150 kernel module on hosts that do not require this USB Ethernet adapter
Physically remove RTL8150-based USB Ethernet adapters from systems that cannot be patched immediately
Restrict physical access to systems where untrusted users could attach an affected USB Ethernet adapter

bash

# Configuration example
# Blocklist the rtl8150 driver until the kernel is patched
echo "blacklist rtl8150" | sudo tee /etc/modprobe.d/blacklist-rtl8150.conf
sudo modprobe -r rtl8150
sudo update-initramfs -u