{"api_version":"1","generated_at":"2026-06-25T15:02:21+00:00","cve":"CVE-2026-53025","urls":{"html":"https://cve.report/CVE-2026-53025","api":"https://cve.report/api/cve/CVE-2026-53025.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-53025","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-53025"},"summary":{"title":"greybus: raw: fix use-after-free on cdev close","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: raw: fix use-after-free on cdev close\n\nThis addresses a use-after-free bug when a raw bundle is disconnected\nbut its chardev is still opened by an application. When the application\nreleases the cdev, it causes the following panic when init on free is\nenabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):\n\n        refcount_t: underflow; use-after-free.\n        WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130\n         ...\n        Call Trace:\n         <TASK>\n         cdev_put+0x18/0x30\n         __fput+0x255/0x2a0\n         __x64_sys_close+0x3d/0x80\n         do_syscall_64+0xa4/0x290\n         entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe cdev is contained in the \"gb_raw\" structure, which is freed in the\ndisconnect operation. When the cdev is released at a later time,\ncdev_put gets an address that points to freed memory.\n\nTo fix this use-after-free, convert the struct device from a pointer to\nbeing embedded, that makes the lifetime of the cdev and of this device\nthe same. Then, use cdev_device_add, which guarantees that the device\nwon't be released until all references to the cdev have been released.\nFinally, delegate the freeing of the structure to the device release\nfunction, instead of freeing immediately in the disconnect callback.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-06-24 17:17:13","updated_at":"2026-06-24 17:17:13"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/ef2d97c15b19b3489de01695bce478601e236c3e","name":"https://git.kernel.org/stable/c/ef2d97c15b19b3489de01695bce478601e236c3e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/983cc2c7efbce04ecbf6328448d895044dd6ab31","name":"https://git.kernel.org/stable/c/983cc2c7efbce04ecbf6328448d895044dd6ab31","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53025","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53025","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 ef2d97c15b19b3489de01695bce478601e236c3e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 983cc2c7efbce04ecbf6328448d895044dd6ab31 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.9","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.9 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.10 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/staging/greybus/raw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ef2d97c15b19b3489de01695bce478601e236c3e","status":"affected","version":"e806c7fb8e9bae87fc23958c3789f2c2f96f54a4","versionType":"git"},{"lessThan":"983cc2c7efbce04ecbf6328448d895044dd6ab31","status":"affected","version":"e806c7fb8e9bae87fc23958c3789f2c2f96f54a4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/staging/greybus/raw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.10","versionStartIncluding":"4.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1","versionStartIncluding":"4.9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: raw: fix use-after-free on cdev close\n\nThis addresses a use-after-free bug when a raw bundle is disconnected\nbut its chardev is still opened by an application. When the application\nreleases the cdev, it causes the following panic when init on free is\nenabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):\n\n        refcount_t: underflow; use-after-free.\n        WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130\n         ...\n        Call Trace:\n         <TASK>\n         cdev_put+0x18/0x30\n         __fput+0x255/0x2a0\n         __x64_sys_close+0x3d/0x80\n         do_syscall_64+0xa4/0x290\n         entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe cdev is contained in the \"gb_raw\" structure, which is freed in the\ndisconnect operation. When the cdev is released at a later time,\ncdev_put gets an address that points to freed memory.\n\nTo fix this use-after-free, convert the struct device from a pointer to\nbeing embedded, that makes the lifetime of the cdev and of this device\nthe same. Then, use cdev_device_add, which guarantees that the device\nwon't be released until all references to the cdev have been released.\nFinally, delegate the freeing of the structure to the device release\nfunction, instead of freeing immediately in the disconnect callback."}],"providerMetadata":{"dateUpdated":"2026-06-24T16:29:33.971Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/ef2d97c15b19b3489de01695bce478601e236c3e"},{"url":"https://git.kernel.org/stable/c/983cc2c7efbce04ecbf6328448d895044dd6ab31"}],"title":"greybus: raw: fix use-after-free on cdev close","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-53025","datePublished":"2026-06-24T16:29:33.971Z","dateReserved":"2026-06-09T07:44:35.379Z","dateUpdated":"2026-06-24T16:29:33.971Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-06-24 17:17:13","lastModifiedDate":"2026-06-24 17:17:13","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"53025","Ordinal":"1","Title":"greybus: raw: fix use-after-free on cdev close","CVE":"CVE-2026-53025","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"53025","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: raw: fix use-after-free on cdev close\n\nThis addresses a use-after-free bug when a raw bundle is disconnected\nbut its chardev is still opened by an application. When the application\nreleases the cdev, it causes the following panic when init on free is\nenabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):\n\n        refcount_t: underflow; use-after-free.\n        WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130\n         ...\n        Call Trace:\n         <TASK>\n         cdev_put+0x18/0x30\n         __fput+0x255/0x2a0\n         __x64_sys_close+0x3d/0x80\n         do_syscall_64+0xa4/0x290\n         entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe cdev is contained in the \"gb_raw\" structure, which is freed in the\ndisconnect operation. When the cdev is released at a later time,\ncdev_put gets an address that points to freed memory.\n\nTo fix this use-after-free, convert the struct device from a pointer to\nbeing embedded, that makes the lifetime of the cdev and of this device\nthe same. Then, use cdev_device_add, which guarantees that the device\nwon't be released until all references to the cdev have been released.\nFinally, delegate the freeing of the structure to the device release\nfunction, instead of freeing immediately in the disconnect callback.","Type":"Description","Title":"greybus: raw: fix use-after-free on cdev close"}]}}}