CVE-2026-53025: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53025 Overview

CVE-2026-53025 is a use-after-free vulnerability in the Linux kernel's greybus raw driver. The flaw occurs when a raw bundle is disconnected while its character device (cdev) remains open by a userspace application. When the application later releases the cdev, the kernel dereferences memory belonging to the already-freed gb_raw structure that contains the cdev.

Critical Impact
Triggering the bug produces a refcount underflow warning and a kernel call trace through cdev_put and __fput, indicating memory corruption that can lead to denial of service or further exploitation when CONFIG_INIT_ON_FREE_DEFAULT_ON=y is set.

Affected Products

Linux kernel greybus subsystem (raw driver, drivers/staging/greybus/raw.c)
Linux distributions shipping the affected kernel versions prior to the upstream fix
Systems built with Greybus support enabled

Discovery Timeline

2026-06-24 - CVE-2026-53025 published to the National Vulnerability Database
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53025

Vulnerability Analysis

The vulnerability is a [CWE-416] use-after-free condition triggered by a lifetime mismatch between the gb_raw device structure and the cdev it contains. The cdev is embedded inside the gb_raw structure, but the structure is freed inside the Greybus disconnect callback regardless of whether userspace still holds the character device open.

When userspace eventually issues close() on the file descriptor, the kernel calls __fput then cdev_put, which decrements a refcount on memory that has already been freed. With CONFIG_INIT_ON_FREE_DEFAULT_ON=y, the freed memory is zeroed, so the refcount becomes zero or negative and the kernel emits refcount_t: underflow; use-after-free. from refcount_warn_saturate.

The call trace observed during the panic traverses entry_SYSCALL_64_after_hwframe → do_syscall_64 → __x64_sys_close → __fput → cdev_put, confirming the unsafe access happens during normal file descriptor close handling.

Root Cause

The root cause is incorrect object-lifetime management. The original code freed the gb_raw structure synchronously in the disconnect handler while the embedded cdev could still be referenced by open file descriptors. The cdev and its containing structure must outlive every open reference held by userspace.

Attack Vector

A local user with permission to open the Greybus raw character device can keep the file descriptor open while the underlying bundle is disconnected, for example through device removal or module-driven teardown. Closing the descriptor afterward triggers the use-after-free. No remote interaction or special protocol exchange is required beyond holding the file descriptor across a disconnect event.

The upstream fix changes the struct device from a pointer to an embedded field, switches registration to cdev_device_add, and moves the kfree into the device release function. See the Kernel Git Commit Patch and the Kernel Git Commit Update for the canonical change.

Detection Methods for CVE-2026-53025

Indicators of Compromise

Kernel log entries containing refcount_t: underflow; use-after-free. originating from lib/refcount.c
Warnings from refcount_warn_saturate with call traces through cdev_put and __fput
Unexpected kernel panics or oops messages immediately following a close() syscall on a Greybus raw chardev
Disconnect events on Greybus bundles closely followed by file descriptor close operations in process accounting logs

Detection Strategies

Audit installed kernel package versions against vendor advisories that incorporate the upstream Greybus raw fix
Enable CONFIG_INIT_ON_FREE_DEFAULT_ON=y and KASAN on test systems to surface latent use-after-free events in the Greybus subsystem
Monitor dmesg and journald for WARNING: CPU: traces that reference cdev_put+0x18/0x30 and __fput
Track loaded kernel modules and confirm whether the greybus and gb-raw modules are present on hosts that do not require them

Monitoring Recommendations

Centralize kernel logs and alert on refcount warnings or oops events tied to character device close paths
Correlate process close() syscalls on /dev/gb!raw* nodes with preceding Greybus disconnect events
Track kernel version inventory across the fleet to confirm patch deployment status

How to Mitigate CVE-2026-53025

Immediate Actions Required

Apply the upstream Linux kernel patch that embeds the struct device in gb_raw and uses cdev_device_add for registration
Update to a distribution kernel that incorporates commit ef2d97c15b19b3489de01695bce478601e236c3e
Restrict access to Greybus raw character device nodes to trusted users where the driver must remain loaded
Reboot affected hosts after patching to ensure the vulnerable module is unloaded

Patch Information

The fix is committed upstream in the Linux kernel. The corrective change embeds the struct device inside gb_raw, registers the character device with cdev_device_add, and moves the kfree of the gb_raw structure into the device release callback so that memory is only freed once all references to the cdev are dropped. Refer to the Kernel Git Commit Patch and the Kernel Git Commit Update for full details.

Workarounds

Unload the gb-raw and greybus modules on systems that do not require Greybus support using modprobe -r
Blacklist the modules in /etc/modprobe.d/ to prevent automatic loading on reboot
Tighten permissions on /dev/gb!raw* nodes through udev rules so that only privileged service accounts can open them

bash

# Blacklist the vulnerable modules until the patched kernel is installed
echo 'blacklist gb-raw' | sudo tee /etc/modprobe.d/blacklist-greybus.conf
echo 'blacklist greybus' | sudo tee -a /etc/modprobe.d/blacklist-greybus.conf
sudo modprobe -r gb-raw greybus 2>/dev/null || true