CVE-2026-90029: usb: storage: realtek_cr: fix use-after-free on disconnect

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: realtekcr: fix use-after-free on disconnect

realtekcrdestructor() calls timerdelete() before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a use-after-free.

Use timershutdownsync() to wait for the callback and prevent further rearming. Do this unconditionally because ssen may be changed after the timer is armed.

Move timersetup() into initrealtekcr() so the timer is initialized before any failure path can invoke the destructor.

Found by static analysis.

Event History

Sep 16, 2026
CVE Published
via MITRE·10:33 AM
Data Sourced
via MITRE·10:33 AM
Description

Frequently Asked Questions

1

What systems are exposed to this issue?

Systems using the Linux kernel's USB storage realtek_cr driver are the relevant population. The flaw is triggered during device disconnect handling, where a timer callback can access a chip object after it has been freed.

2

What condition is required for exploitation or triggering?

A Realtek card-reader device handled by realtek_cr must be disconnected while its timer callback is running or able to run. The callback can rearm the timer after timer_delete() and then operate on freed memory.

3

Does the vulnerable path depend on the ss_en setting?

No. The fix shuts down the timer unconditionally because ss_en can change after the timer has been armed.

4

What does the fix change to prevent the use-after-free?

It replaces timer_delete() with timer_shutdown_sync(), which waits for an active callback and prevents the timer from being rearmed. It also initializes the timer in init_realtek_cr() before failure paths can call the destructor.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203