CVE-2026-52982

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()

when accessing skb->len for tx statistics after usb_submit_urb() has

been called:

BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760

drivers/net/usb/rtl8150.c:712

Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226

The URB completion handler write_bulk_callback() frees the skb via

dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU

in softirq context before usb_submit_urb() returns in the submitter,

so by the time the submitter reads skb->len the skb has already been

queued to the per-CPU completion_queue and freed by net_tx_action():

CPU A (xmit) CPU B (USB completion softirq)

------------ ------------------------------

dev->tx_skb = skb;

usb_submit_urb() --+

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References