CVE-2026-90029

usb: storage: realtek_cr: fix use-after-free on disconnect

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: realtek_cr: fix use-after-free on disconnect

realtek_cr_destructor() calls timer_delete() before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a use-after-free.

Use timer_shutdown_sync() to wait for the callback and prevent further rearming. Do this unconditionally because ss_en may be changed after the timer is armed.

Move timer_setup() into init_realtek_cr() so the timer is initialized before any failure path can invoke the destructor.

Found by static analysis.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e931830bb877e2aad9a1be83506f9bdb26c91e4e to before f98c2f119fcd81cfede114d2fd3463a17aed8209Affected e931830bb877e2aad9a1be83506f9bdb26c91e4e to before 0935e57ede003bbe35de9c5d6a49260999ca0314Affected e931830bb877e2aad9a1be83506f9bdb26c91e4e to before c1e7e35100efffba7c9e1dfa76519d6cd323ba3dAffected e931830bb877e2aad9a1be83506f9bdb26c91e4e to before 524d4257f741cd95eb85e2817c9c890928fcfef7Affected e931830bb877e2aad9a1be83506f9bdb26c91e4e to before 7c4e2f964c65dea4ea22386799d5fb10ef1e3e54Affected e931830bb877e2aad9a1be83506f9bdb26c91e4e to before cae9dbba6adae21a04a3bd045e07b489847ff2c6Affected e931830bb877e2aad9a1be83506f9bdb26c91e4e to before 4ffee1aebb0c0ffcda9faffd17834ea9b00d42ccAffected
LinuxLinux	3.1Affected before 3.1Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e931830bb877e2aad9a1be83506f9bdb26c91e4e to before f98c2f119fcd81cfede114d2fd3463a17aed8209Affected
e931830bb877e2aad9a1be83506f9bdb26c91e4e to before 0935e57ede003bbe35de9c5d6a49260999ca0314Affected
e931830bb877e2aad9a1be83506f9bdb26c91e4e to before c1e7e35100efffba7c9e1dfa76519d6cd323ba3dAffected
e931830bb877e2aad9a1be83506f9bdb26c91e4e to before 524d4257f741cd95eb85e2817c9c890928fcfef7Affected
e931830bb877e2aad9a1be83506f9bdb26c91e4e to before 7c4e2f964c65dea4ea22386799d5fb10ef1e3e54Affected
e931830bb877e2aad9a1be83506f9bdb26c91e4e to before cae9dbba6adae21a04a3bd045e07b489847ff2c6Affected
e931830bb877e2aad9a1be83506f9bdb26c91e4e to before 4ffee1aebb0c0ffcda9faffd17834ea9b00d42ccAffected

LinuxLinux

3.1Affected
before 3.1Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.