CVE-2026-90029 Overview
CVE-2026-90029 is a use-after-free vulnerability in the Linux kernel realtek_cr USB storage driver. The flaw resides in realtek_cr_destructor(), which calls timer_delete() before freeing the chip structure that contains the timer. Because the timer callback may still be executing and can rearm itself, kernel memory can be accessed after it has been released. The issue was discovered through static analysis and resolved by switching to timer_shutdown_sync() and moving timer_setup() into init_realtek_cr() so the timer is initialized before any failure path can invoke the destructor.
Critical Impact
A use-after-free triggered during USB device disconnect can lead to kernel memory corruption, potentially resulting in denial of service or local privilege escalation on systems using Realtek USB card reader storage devices.
Affected Products
- Linux kernel drivers/usb/storage/realtek_cr.c
- Systems with Realtek USB card reader storage devices attached
- Distributions shipping vulnerable Linux kernel versions prior to the fix commits
Discovery Timeline
- 2026-09-16 - CVE-2026-90029 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90029
Vulnerability Analysis
The vulnerability is a Use-After-Free condition in the realtek_cr USB storage driver. During device disconnect, realtek_cr_destructor() invokes timer_delete() on a timer embedded within the driver's chip structure. timer_delete() does not wait for a currently executing callback to complete, and it does not prevent the callback from rearming the timer. When the destructor subsequently frees the chip structure, a still-running timer callback holds a reference to freed memory. Any dereference of that reference produces a use-after-free.
The race window opens whenever a Realtek USB card reader is disconnected while its polling or auto-suspend timer is active. Because the timer callback path can re-queue the timer, even a successful timer_delete() call does not guarantee the timer is fully quiesced.
Root Cause
The root cause is incorrect timer teardown semantics. timer_delete() deactivates a pending timer but neither synchronizes with an in-flight callback nor blocks future arming from within that callback. The condition variable ss_en (selective suspend enable) could also be modified after the timer was armed, meaning conditional teardown logic could not reliably determine whether the timer was active. Additionally, timer_setup() was performed outside init_realtek_cr(), so early failure paths could reach the destructor before the timer was properly initialized.
Attack Vector
Exploitation requires local physical or logical access to attach and disconnect a Realtek USB card reader device, or a controlled disconnect event on an existing device. The vulnerability triggers in kernel context during the USB disconnect handler. Successful exploitation depends on winning the race between the timer callback and the free operation, and on shaping the freed slab memory to influence subsequent callback behavior. The fix uses timer_shutdown_sync() unconditionally, which waits for any running callback and prevents further rearming, then moves timer_setup() into init_realtek_cr().
The upstream patches are available in the Linux kernel commits 4ffee1a, 7c4e2f, and cae9dbb.
Detection Methods for CVE-2026-90029
Indicators of Compromise
- Kernel oops or KASAN reports referencing realtek_cr_destructor, rts51x_suspend_timer_fn, or slab-use-after-free in usb-storage
- Unexpected kernel panics correlated with USB card reader disconnect events
- dmesg entries showing usb-storage driver faults immediately following a device unplug
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test kernels to catch use-after-free conditions in drivers/usb/storage/realtek_cr.c
- Audit installed kernel versions against the fixed commits to identify unpatched systems
- Monitor kernel ring buffer for WARN_ON or BUG traces originating from the USB storage subsystem
Monitoring Recommendations
- Collect and centralize dmesg and journalctl -k output from Linux endpoints for kernel fault analysis
- Alert on repeated USB storage disconnect events on the same host that coincide with kernel warnings
- Track kernel package versions across the fleet to confirm patch deployment status
How to Mitigate CVE-2026-90029
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 4ffee1a, 7c4e2f, and cae9dbb, or update to a distribution kernel that incorporates them
- Inventory systems that use Realtek USB card readers and prioritize them for patching
- Restrict physical access to systems where kernel updates cannot be applied immediately
Patch Information
The fix replaces timer_delete() with timer_shutdown_sync() in realtek_cr_destructor() and relocates timer_setup() into init_realtek_cr(). timer_shutdown_sync() waits for any running callback to complete and prevents the timer from being rearmed, closing the race window. The change is applied unconditionally because the ss_en flag may be modified after the timer is armed. Patches are available at kernel.org commit 4ffee1a, kernel.org commit 7c4e2f, and kernel.org commit cae9dbb.
Workarounds
- Blacklist the ums_realtek kernel module on systems that do not require Realtek USB card reader support until a patched kernel is installed
- Disable USB storage device attachment via udev rules or USBGuard policies on high-value hosts
- Avoid hot-unplugging Realtek USB card readers on unpatched systems and shut down the device cleanly before removal
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.