SB2026091691 - Use-after-free in Linux kernel usb storage driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-90029)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the Realtek USB card reader driver's suspend timer handling when disconnecting a USB device while the timer callback is running. An attacker with physical access can disconnect the device while the callback rearms the timer to trigger a use-after-free.

The issue applies to configurations with Realtek automatic power management enabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc
• https://git.kernel.org/stable/c/7c4e2f964c65dea4ea22386799d5fb10ef1e3e54
• https://git.kernel.org/stable/c/cae9dbba6adae21a04a3bd045e07b489847ff2c6