CVE-2026-52982: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

Synopsis

A use-after-free vulnerability exists in the Linux kernel's rtl8150 USB network driver, specifically in the rtl8150_start_xmit() function. The flaw is reachable over the network with no authentication required, because a remote peer triggering transmit completion on a second CPU can free the socket buffer (skb) before the submitting CPU finishes reading skb->len for statistics. Successful exploitation allows an attacker to read freed kernel memory, corrupt kernel data structures, or crash the host, enabling full confidentiality loss, data tampering, and denial of service. Patched-image rebuilds at the fix commits are available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is exercised during USB transmit, which can be triggered by network traffic arriving over the network interface, so the attacker must be able to reach the target service over the network.

• AuthenticationNot required

  No authentication is required; the CVSS vector specifies PR:N, meaning an unauthenticated remote peer can trigger the race condition.

• Victim interactionNot required

  No user or administrator action is needed to trigger exploitation; the race condition occurs automatically during normal transmit processing (UI:N).

• Attack complexityDetail

  Attack complexity is rated Low (AC:L), meaning the race condition can be reliably triggered without needing specific memory layouts, timing windows beyond normal concurrent CPU execution, or other environmental preconditions.

Blast Radius

• An attacker who wins the race reads freed kernel slab memory, which can expose sensitive kernel data including credentials, session tokens, or key material held in recently freed buffers.
• The freed memory region can be reallocated and overwritten, allowing corruption of kernel data structures and enabling privilege escalation or arbitrary code execution in kernel context.
• The invalid memory read can trigger a kernel panic, crashing the host and taking down all workloads running on the affected node.
• Any container or workload sharing the host kernel is affected if the vulnerable rtl8150 USB network driver is loaded, regardless of network namespace isolation.