CVE-2026-90029: usb: storage: realtek_cr: fix use-after-free on disconnect
In the Linux kernel, the following vulnerability has been resolved:
usb: storage: realtekcr: fix use-after-free on disconnect
realtekcrdestructor() calls timerdelete() before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a use-after-free.
Use timershutdownsync() to wait for the callback and prevent further rearming. Do this unconditionally because ssen may be changed after the timer is armed.
Move timersetup() into initrealtekcr() so the timer is initialized before any failure path can invoke the destructor.
Found by static analysis.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel's USB storage realtek_cr driver are the relevant population. The flaw is triggered during device disconnect handling, where a timer callback can access a chip object after it has been freed.
What condition is required for exploitation or triggering?
A Realtek card-reader device handled by realtek_cr must be disconnected while its timer callback is running or able to run. The callback can rearm the timer after timer_delete() and then operate on freed memory.
Does the vulnerable path depend on the ss_en setting?
No. The fix shuts down the timer unconditionally because ss_en can change after the timer has been armed.
What does the fix change to prevent the use-after-free?
It replaces timer_delete() with timer_shutdown_sync(), which waits for an active callback and prevents the timer from being rearmed. It also initializes the timer in init_realtek_cr() before failure paths can call the destructor.