CVE-2026-90029 usb: storage: realtek_cr: fix use-after-free on disconnect
A use-after-free vulnerability in the Linux kernel's Realtek USB storage driver allows local attackers to execute code or cause a denial of service via device disconnection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90029?
CVE-2026-90029 is an use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: storage: realtek_cr: fix use-after-free on disconnect
realtek_cr_destructor() calls timer_delete() before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a use-after-free.
Use timer_shutdown_sync() to wait for the callback and prevent further rearming. Do this unconditionally because ss_en may be changed after the timer is armed.
Move timer_setup() into init_realtek_cr() so the timer is initialized before any failure path can invoke the destructor.
Found by static analysis.
Which versions are affected by CVE-2026-90029?
How do I fix CVE-2026-90029?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90029 being exploited?
There is no known exploitation of CVE-2026-90029 in the wild and no public exploit code.
Sources
Also known as AZL-101447, BELL-CVE-2026-90029, DEBIAN-CVE-2026-90029, GHSA-m7jg-4wjg-p9fx, UBUNTU-CVE-2026-90029.