Answer in brief
CVE-2026-52982 records a Critical severity (CVSS 9.8) vulnerability in net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5af290c86fa81ddbc86a08d54229af5daa40c6a4 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <24831b0b2ada9fef18d1f486b7b7c444ee5ba637 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <423b5b86e14e190f6e3161eb5f2ea5f908295ba7 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5db090ca07b28a63fb1499690cf19a3f3adafacb || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <30cf9829d09ca958279c937af8e35495cd2f1e09 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6999d70e0eda39af029fa1891c48f0a8832b09d5 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4dd7eb94f79486b77ca6b4c8676aedbc465dc802 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <23f0e34c64acba15cad4d23e50f41f533da195fa | 5af290c86fa81ddbc86a08d54229af5daa40c6a4, 24831b0b2ada9fef18d1f486b7b7c444ee5ba637, 423b5b86e14e190f6e3161eb5f2ea5f908295ba7, 5db090ca07b28a63fb1499690cf19a3f3adafacb, 30cf9829d09ca958279c937af8e35495cd2f1e09, 6999d70e0eda39af029fa1891c48f0a8832b09d5, 4dd7eb94f79486b77ca6b4c8676aedbc465dc802, 23f0e34c64acba15cad4d23e50f41f533da195fa |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after usb_submit_urb() has been called: BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760 drivers/net/usb/rtl8150.c:712 Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226 The URB completion handler write_bulk_callback() frees the skb via dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU in softirq context before usb_submit_urb() returns in the submitter, so by the time the submitter reads skb->len the skb has already been queued to the per-CPU completion_queue and freed by net_tx_action(): CPU A (xmit) CPU B (USB completion softirq) ------------ ------------------------------ dev->tx_skb = skb; usb_submit_urb() --+ |-------> write_bulk_callback() | dev_kfree_skb_irq(dev->tx_skb) | net_tx_action() | napi_skb_cache_put() <-- free netdev->stats.tx_bytes | += skb->len; <-- UAF read Fix it by caching skb->len before submitting the URB and using the cached value when updating the tx_bytes counter. The pre-existing tx_bytes semantics are preserved: the counter tracks the original frame length (skb->len), not the ETH_ZLEN/USB-alignment padded "count" value that is handed to the device. Changing that would be a user-visible accounting change and is out of scope for this UAF fix.
Quoted source text, attributed separately from HOL analysis.