CVE-2026-53025

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> greybus: raw: fix use-after-free on cdev close<br /> <br /> This addresses a use-after-free bug when a raw bundle is disconnected<br /> but its chardev is still opened by an application. When the application<br /> releases the cdev, it causes the following panic when init on free is<br /> enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):<br /> <br /> refcount_t: underflow; use-after-free.<br /> WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130<br /> ...<br /> Call Trace:<br /> <br /> cdev_put+0x18/0x30<br /> __fput+0x255/0x2a0<br /> __x64_sys_close+0x3d/0x80<br /> do_syscall_64+0xa4/0x290<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> The cdev is contained in the "gb_raw" structure, which is freed in the<br /> disconnect operation. When the cdev is released at a later time,<br /> cdev_put gets an address that points to freed memory.<br /> <br /> To fix this use-after-free, convert the struct device from a pointer to<br /> being embedded, that makes the lifetime of the cdev and of this device<br /> the same. Then, use cdev_device_add, which guarantees that the device<br /> won&amp;#39;t be released until all references to the cdev have been released.<br /> Finally, delegate the freeing of the structure to the device release<br /> function, instead of freeing immediately in the disconnect callback.