CVE-2026-53025: Linux Kernel Greybus Use-After-Free Denial of Service

Technical summary

CVE-2026-53025 is a use-after-free flaw in drivers/greybus/raw.c where the character device (cdev) lifetime is not properly synchronized with the underlying gb_raw device structure. The gb_raw structure, which contains an embedded cdev, is freed during a Greybus bundle disconnect operation. If an application holds an open file descriptor to the cdev at that moment, a subsequent close() syscall invokes cdev_put() on a pointer to already-freed memory, causing a refcount underflow. The vulnerability is particularly dangerous when CONFIG_INIT_ON_FREE_DEFAULT_ON is enabled, as the kernel's memory initialization routines detect and report the corruption. The fix involves converting the struct device from a pointer to an embedded member and using cdev_device_add() to bind the cdev lifecycle to the device lifecycle, with cleanup delegated to the device release callback.

Business impact

This vulnerability allows a local attacker with user-level privileges to crash the kernel on systems running affected Linux versions, resulting in denial of service. While not a direct data breach vector, the crash can interrupt critical services, cause data loss from ungraceful termination, and leave systems in an unstable state. For embedded systems, IoT devices, or infrastructure relying on Greybus (typically used in modular hardware architectures), this represents a reliability and availability risk. Attack complexity is low—an attacker needs only to disconnect a Greybus raw device while an application holds the file descriptor open.

Affected systems

The vulnerability affects the Linux kernel. Any Linux distribution or system running kernel versions containing the vulnerable Greybus raw driver code path is at risk. Greybus is primarily used in specialized embedded and mobile environments; mainstream enterprise servers are less likely to be affected unless they employ modular or hot-pluggable hardware using Greybus interfaces. The vulnerability requires the affected code to be compiled into the kernel and Greybus raw driver to be active.

Exploitability

Exploitability is moderate to high for affected systems. The attack requires local access and the ability to manage device files and load/unload Greybus bundles, which typically requires root or device administrator privileges to orchestrate, though the vulnerability itself can be triggered by an unprivileged user holding an open file descriptor. No network access is needed. The race condition window is relatively tight—the device must be disconnected while the cdev is held open—but triggering this scenario is straightforward with basic shell scripting or a custom application. Public exploit code would be trivial to produce. The vulnerability is not listed in the CISA KEV catalog as of the published date, indicating it may not yet be actively exploited in the wild at scale.

Remediation

Apply a kernel patch that restructures the gb_raw device handling to embed the struct device directly rather than maintaining it as a pointer, and updates the probe and disconnect logic to use cdev_device_add() and cdev_device_del() instead of manual cdev lifecycle management. This ensures the underlying device structure remains valid until all cdev references are released. Verify the patch is included in your kernel version via your distribution's advisory or upstream kernel release notes.

Patch guidance

Obtain the fix from your Linux distribution's security advisory or upstream kernel updates. Users should verify that their kernel version includes the corrected Greybus raw driver code. To confirm, consult your distribution's patch repository or check the upstream Linux kernel commit log for the specific fix to drivers/greybus/raw.c. Distributions typically backport critical fixes to stable kernel branches; check your vendor's security advisory for the recommended kernel version. A full system reboot is required after kernel update to apply the fix.

Detection guidance

Monitor kernel logs for refcount underflow warnings or panics originating from lib/refcount.c:28 or cdev_put() calls, particularly those referencing Greybus bundle disconnection events. These warnings often appear when CONFIG_INIT_ON_FREE_DEFAULT_ON is enabled. Audit access to Greybus raw device character devices (/dev/raw-gb*) to identify which processes hold them open for extended periods. Set up alerting on kernel oops or panic messages involving the Greybus driver. In containerized or virtualized environments, monitor for unexpected container/VM crashes correlated with device hot-plug or Greybus bundle events.

Why prioritize this

This vulnerability merits priority patching due to its HIGH CVSS score (7.8), local privilege escalation potential, and ease of triggering once an attacker gains local access. While it requires local access and does not lead to data exfiltration directly, the denial-of-service impact and crash severity make it a stability concern for production systems. The fix is straightforward and low-risk; delaying patching leaves systems unnecessarily exposed to a simple, repeatable crash condition. Organizations using Greybus-based hardware or modular device architectures should prioritize this urgently.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score is driven primarily by the availability impact—kernel panic and denial of service—combined with the demonstrated potential for memory corruption. Although the vulnerability requires local access, the straightforward triggering mechanism and the critical nature of kernel stability justify the HIGH severity rating.

Frequently asked questions