{"id":"CVE-2026-90029","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: realtek_cr: fix use-after-free on disconnect\n\nrealtek_cr_destructor() calls timer_delete() before the chip containing\nthe timer is freed","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: realtek_cr: fix use-after-free on disconnect\n\nrealtek_cr_destructor() calls timer_delete() before the chip containing\nthe timer is freed. The timer callba…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e931830bb877e2aad9a1be83506f9bdb26c91e4e < 7c4e2f964c65dea4ea22386799d5fb10ef1e3e54","Linux >= e931830bb877e2aad9a1be83506f9bdb26c91e4e < cae9dbba6adae21a04a3bd045e07b489847ff2c6","Linux >= e931830bb877e2aad9a1be83506f9bdb26c91e4e < 4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc","Linux 3.1"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T11:17:15.953","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90029","references":[{"url":"https://git.kernel.org/stable/c/4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c4e2f964c65dea4ea22386799d5fb10ef1e3e54","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cae9dbba6adae21a04a3bd045e07b489847ff2c6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.933Z","epss":0.00184,"epssPercentile":0.08246,"slug":"CVE-2026-90029","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: realtek_cr: fix use-after-free on disconnect\n\nrealtek_cr_destructor() calls timer_delete() before the chip containing\nthe timer is freed. The timer callback may still be running and can\nrearm itself, resulting in a use-after-free.\n\nUse timer_shutdown_sync() to wait for the callback and prevent further\nrearming. Do this unconditionally because ss_en may be changed after\nthe timer is armed.\n\nMove timer_setup() into init_realtek_cr() so the timer is initialized\nbefore any failure path can invoke the destructor.\n\nFound by static analysis.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}