{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()\\n\\nsyzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()\\nwhen accessing skb-\\u003elen for tx statistics after usb_submit_urb() has\\nbeen called:\\n\\n BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f\/0x760\\n drivers\/net\/usb\/rtl8150.c:712\\n Read of size 4 at addr ffff88810eb7a930 by task kworker\/0:4\/5226\\n\\nThe URB completion handler write_bulk_callback() frees the skb via\\ndev_kfree_skb_irq(dev-\\u003etx_skb). The URB may complete on another CPU\\nin softirq context before usb_submit_urb() returns in the submitter,\\nso by the time the submitter reads skb-\\u003elen the skb has already been\\nqueued to the per-CPU completion_queue and freed by net_tx_action():\\n\\n CPU A (xmit) CPU B (USB completion softirq)\\n ———— ——————————\\n dev-\\u003etx_skb = skb;\\n usb_submit_urb() –+\\n |——-\\u003e write_bulk_callback()\\n | dev_kfree_skb_irq(dev-\\u003etx_skb)\\n | net_tx_action()\\n | napi_skb_cache_put() \\u003c– free\\n netdev-\\u003estats.tx_bytes |\\n += skb-\\u003elen; \\u003c– UAF read\\n\\nFix it by caching skb-\\u003elen before submitting the URB and using the\\ncached value when updating the tx_bytes counter.\\n\\nThe pre-existing tx_bytes semantics are preserved: the counter tracks\\nthe original frame length (skb-\\u003elen), not the ETH_ZLEN\/USB-alignment\\npadded \\”count\\” value that is handed to the device. Changing that\\nwould be a user-visible accounting change and is out of scope for\\nthis UAF fix.”,”published”:”2026-06-24T16:28:57.763Z”,”modified”:”2026-06-28T06:37:35.269Z”,”type”:”cve”,”title”:”net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/5af290c86fa81ddbc86a08d54229af5daa40c6a4\\nhttps:\/\/git.kernel.org\/stable\/c\/24831b0b2ada9fef18d1f486b7b7c444ee5ba637\\nhttps:\/\/git.kernel.org\/stable\/c\/423b5b86e14e190f6e3161eb5f2ea5f908295ba7\\nhttps:\/\/git.kernel.org\/stable\/c\/5db090ca07b28a63fb1499690cf19a3f3adafacb\\nhttps:\/\/git.kernel.org\/stable\/c\/30cf9829d09ca958279c937af8e35495cd2f1e09\\nhttps:\/\/git.kernel.org\/stable\/c\/6999d70e0eda39af029fa1891c48f0a8832b09d5\\nhttps:\/\/git.kernel.org\/stable\/c\/4dd7eb94f79486b77ca6b4c8676aedbc465dc802\\nhttps:\/\/git.kernel.org\/stable\/c\/23f0e34c64acba15cad4d23e50f41f533da195fa”,”id”:”CVE-2026-52982″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 2.6.12″,”sourceHref”:””,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”1da177e4c3f41524e886b7f1b8a0c1fc7321cac2″,”vendor”:”Linux”,”ai_description”:”AI processing failed – invalid JSON response”,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()\\n\\nsyzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()\\nwhen accessing skb-\\u003elen…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9,6,8,35,12,13,7,11,5],"class_list":["post-66562","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n