CVE-2026-52982: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
In the Linux kernel, the following vulnerability has been resolved:
Other sources
net: usb: rtl8150: fix use-after-free in rtl8150startxmit()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-2Fixed in 7.1.10-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.180-1~deb11u1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - Configuration
In drivers/net/usb/rtl8150.c, fix the UAF in rtl8150_start_xmit() by caching skb->len before submitting the URB, and use the cached value when updating netdev->stats.tx_bytes after usb_submit_urb() returns. This preserves pre-existing tx_bytes semantics (track the original frame length skb->len, not the padded/alignment count used for the device).
Linux kernel (net/usb/rtl8150.c) Cache skb->len before calling usb_submit_urb() and use cached length for tx statistics (netdev->stats.tx_bytes) after completion = enabled
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running an affected Linux kernel with the rtl8150 USB network driver in use are exposed. The listed affected software includes the Linux kernel, Microsoft azl3 kernel 6.6.139.1-1, and Debian linux and linux-6.1 packages.
What conditions are needed to trigger the use-after-free?
The race occurs during transmit processing when a USB URB completion runs on another CPU in softirq context before usb_submit_urb() returns. The completion handler can free the transmit skb before rtl8150_start_xmit() reads skb->len for transmit statistics.
How can this be mitigated if an update cannot be applied immediately?
The provided information identifies the rtl8150 USB network driver as the affected component. Limiting use of RTL8150 USB network hardware or preventing the rtl8150 driver from being used reduces exposure until a fixed kernel is installed.