Answer in brief
CVE-2026-53024 records a High severity (CVSS 7.8) vulnerability in greybus: raw: fix use-after-free if write is called after disconnect. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <48d6c32bc049abd114e8f0836c0e7d7cbfba7827 || >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <84265cbd96b97058ef67e3f8be3933667a000835 | 48d6c32bc049abd114e8f0836c0e7d7cbfba7827, 84265cbd96b97058ef67e3f8be3933667a000835 |
| Linux/Linuxgeneric | 4.9 | Not reported |
| Linux/Linuxgeneric | >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <966b941ca469fb794637a0803670454f68515e40 || >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <2b46f07913a80521ecfe60b229c84bdd7dfb15ab || >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <48d6c32bc049abd114e8f0836c0e7d7cbfba7827 || >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <84265cbd96b97058ef67e3f8be3933667a000835 | 966b941ca469fb794637a0803670454f68515e40, 2b46f07913a80521ecfe60b229c84bdd7dfb15ab, 48d6c32bc049abd114e8f0836c0e7d7cbfba7827, 84265cbd96b97058ef67e3f8be3933667a000835 |
| Linux/Linuxgeneric | >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <5a6ce05ccd9eca653b09d67eb59026821ffaf61b || >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <966b941ca469fb794637a0803670454f68515e40 || >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <2b46f07913a80521ecfe60b229c84bdd7dfb15ab || >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <48d6c32bc049abd114e8f0836c0e7d7cbfba7827 || >=e806c7fb8e9bae87fc23958c3789f2c2f96f54a4 <84265cbd96b97058ef67e3f8be3933667a000835 | 5a6ce05ccd9eca653b09d67eb59026821ffaf61b, 966b941ca469fb794637a0803670454f68515e40, 2b46f07913a80521ecfe60b229c84bdd7dfb15ab, 48d6c32bc049abd114e8f0836c0e7d7cbfba7827, 84265cbd96b97058ef67e3f8be3933667a000835 |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free if write is called after disconnect If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y): BUG: kernel NULL pointer dereference, address: 0000000000000218 ... Call Trace: <TASK> gb_operation_create_common+0x61/0x180 gb_operation_create_flags+0x28/0xa0 gb_operation_sync_timeout+0x6f/0x100 raw_write+0x7b/0xc7 [gb_raw] vfs_write+0xcf/0x420 ? task_mm_cid_work+0x136/0x220 ksys_write+0x63/0xe0 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f Disconnect calls gb_connection_destroy, which ends up freeing the connection object. When gb_operation_sync is called in the write file operations, its gets a freed connection as parameter and the kernel panics. The gb_connection_destroy cannot be moved out of the disconnect function, as the Greybus subsystem expect all connections belonging to a bundle to be destroyed when disconnect returns. To prevent this bug, use a rw lock to synchronize access between write and disconnect. This guarantees that the write function doesn't try to use a disconnected connection.
Quoted source text, attributed separately from HOL analysis.