CVE-2026-53024: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53024 Overview

CVE-2026-53024 is a use-after-free vulnerability in the Linux kernel's Greybus raw driver (gb_raw). The flaw allows a user-space process to trigger a kernel NULL pointer dereference by writing to the character device after the underlying Greybus connection has been disconnected. The disconnect path calls gb_connection_destroy, which frees the connection object, while a concurrent or subsequent raw_write call passes the freed pointer into gb_operation_sync_timeout. The result is a kernel panic and denial of service on affected systems running the Greybus subsystem.

Critical Impact
Local users with access to a Greybus raw character device can trigger a kernel panic, resulting in denial of service on the host.

Affected Products

Linux kernel — Greybus raw driver (drivers/staging/greybus/raw.c / gb_raw module)
Linux kernel builds with CONFIG_GREYBUS_RAW enabled
Linux kernel builds with CONFIG_INIT_ON_FREE_DEFAULT_ON=y reliably reproduce the panic

Discovery Timeline

2026-06-24 - CVE-2026-53024 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53024

Vulnerability Analysis

The vulnerability is a classic use-after-free in the Greybus raw character device driver. When a Greybus bundle is disconnected, the subsystem invokes the driver's disconnect callback, which calls gb_connection_destroy and releases the gb_connection object. The driver's write file operation, however, does not synchronize with disconnect. If user space issues a write() on the chardev after disconnect has run, raw_write calls gb_operation_sync_timeout with a freed connection pointer.

The reported call trace shows the dereference occurring inside gb_operation_create_common after being reached via raw_write → gb_operation_sync_timeout → gb_operation_create_flags. With CONFIG_INIT_ON_FREE_DEFAULT_ON=y, freed memory is zeroed, so the access faults as a NULL pointer dereference at offset 0x218. Without this hardening option, the same code path can read attacker-influenced stale heap contents, broadening the impact beyond a deterministic panic.

Root Cause

The root cause is missing synchronization between the raw_write file operation and the Greybus disconnect callback. The Greybus subsystem requires that all connections belonging to a bundle be destroyed when disconnect returns, so gb_connection_destroy cannot be deferred. Without a lock guarding access to the connection, write can race with or follow disconnect and dereference a freed object.

Attack Vector

A local user with an open file descriptor to a Greybus raw chardev triggers the bug by issuing write(2) after the corresponding Greybus device has been disconnected. The fix introduces a read-write lock to serialize access: the write path takes the read lock and verifies the connection is still valid, while disconnect takes the write lock before destroying the connection. This guarantees raw_write never operates on a freed gb_connection.

No verified public proof-of-concept code is available. The mechanism is documented in the upstream commits referenced in Kernel Git Commit 48d6c32 and Kernel Git Commit 84265cbd.

Detection Methods for CVE-2026-53024

Indicators of Compromise

Kernel panic logs containing BUG: kernel NULL pointer dereference, address: 0000000000000218 with a call stack referencing raw_write+0x7b/0xc7 [gb_raw].
dmesg entries showing gb_operation_create_common and gb_operation_sync_timeout immediately preceding a fault on a host using Greybus.
Unexpected reboots or kernel oops events on systems exposing /dev/gb-raw-* character devices.

Detection Strategies

Monitor /var/log/kern.log and journalctl -k for oops or panic signatures involving the gb_raw module.
Inventory hosts with CONFIG_GREYBUS_RAW=y or the gb_raw module loaded using lsmod | grep gb_raw.
Audit processes opening Greybus raw chardevs and correlate with disconnect events from udev and Greybus bundle removal messages.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on gb_raw fault signatures.
Track loaded kernel module versions across the fleet and compare against patched kernel builds.
Alert on repeated kernel oops events from the same host, which may indicate triggering of this or related races.

How to Mitigate CVE-2026-53024

Immediate Actions Required

Upgrade to a Linux kernel release that includes the upstream fixes referenced in the NVD entry.
Unload the gb_raw module on systems that do not require Greybus raw functionality using modprobe -r gb_raw.
Restrict access to Greybus raw character devices to trusted users via filesystem permissions or device manager rules.

Patch Information

The issue is resolved by adding a read-write lock that synchronizes the raw_write and disconnect paths in the Greybus raw driver. The write path acquires the read lock and validates the connection before calling gb_operation_sync_timeout, while the disconnect path acquires the write lock before invoking gb_connection_destroy. See Kernel Git Commit 48d6c32 and Kernel Git Commit 84265cbd for the patches.

Workarounds

Blacklist the gb_raw module on hosts that do not need Greybus raw device support.
Restrict permissions on /dev/gb-raw-* so only privileged service accounts can open and write to the chardev.
Avoid hot-removing Greybus devices while user-space writers hold open file descriptors until the patched kernel is deployed.

bash

# Blacklist the gb_raw module until a patched kernel is installed
echo "blacklist gb_raw" | sudo tee /etc/modprobe.d/blacklist-gb_raw.conf
sudo modprobe -r gb_raw