CVE Intelligence
Analysis AI-assisted

CVE-2026-52982: Linux kernel rtl8150 driver: use-after-free in transmit path

A use-after-free (CWE-416) in the rtl8150 USB Ethernet driver of the Linux kernel can occur when the transmit routine reads skb->len after the USB request has already been submitted. The CNA scores it 9.8 (CVSS 3.1), and the record lists several stable kernel ranges as affected. The sources consulted show no confirmed exploitation and the vulnerability is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-52982 affects the rtl8150 USB Ethernet driver in the Linux kernel. According to the record, the transmit function rtl8150_start_xmit() reads skb->len for interface statistics after the USB request has been submitted, while the completion path may already have freed that buffer. The upstream fix caches the length before submission and uses the cached value for the tx_bytes counter.

Impact

  • The record classifies the weakness as CWE-416 (Use After Free).
  • The CNA-provided CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8.
  • The description confirms a KASAN-reported read of freed memory. The sources consulted do not describe what an attacker could achieve from this read, so the practical impact beyond the scored values is unknown.
  • The reported problem is a memory-safety defect in a driver used with USB-attached adapters, so exposure depends on whether the driver is present and in use on a given system.

Affected products and versions

The record lists the Linux Linux Kernel product with these ranges:

  • From 2.6.12.1 up to, but not including, 5.10.258
  • From 5.11 up to, but not including, 5.15.209
  • From 5.16 up to, but not including, 6.1.175
  • From 6.2 up to, but not including, 6.6.141
  • From 6.7 up to, but not including, 6.12.91
  • From 6.13 up to, but not including, 6.18.33
  • From 6.19 up to, but not including, 7.0.10
  • Individually listed: 2.6.12, 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5 and 7.1-rc1

The record does not explicitly map a fixed version to each branch. The upper bounds above are the first excluded versions, which suggests that the stable releases at those numbers contain the fix. This is an inference and should be confirmed against the kernel stable changelogs and your distribution's advisories. The record also links eight stable-tree commits that carry the fix.

Exploitation status

The CISA KEV entry is not listed for this CVE, so no active exploitation is reported by that catalogue. No confirmed exploitation appears in the sources consulted. EPSS data is not present in the record, so the exploitation probability is unknown.

Remediation and mitigation

  • Update the Linux kernel to a stable release that includes the upstream fix for the affected branch, and apply the patches provided by your distribution.
  • Where a USB adapter using the rtl8150 driver is not required, consider disabling or unloading that driver as a temporary measure, after confirming the impact on your hardware.
  • Prioritise systems that expose USB Ethernet adapters to untrusted physical or hypervisor-level access, since physical access can change the risk profile.
  • Track vendor kernel advisories, because backported fixes may use different version numbers than upstream.

Detection guidance

  • Inventory systems running affected kernel ranges and identify whether the rtl8150 module is present or loaded.
  • Review kernel logs for KASAN or slab-use-after-free reports that reference rtl8150_start_xmit. Such reports are most likely in test or debug kernels, and their absence does not prove that a system is safe.
  • Monitor for unexpected network interface or USB device behaviour, while recognising that these signals are not specific to this flaw.

Limitations of the available information

  • The record does not state a fixed version per branch or per distribution.
  • The record does not provide exploitation details, proof of concept information or an exploit-availability assessment, and this analysis does not add any.
  • The record contains no EPSS score, and the SSVC field is empty.
  • The CVSS data comes from the CNA. No separate NVD scoring is included in the record.
  • Whether the affected driver is enabled in common distribution kernels is not stated in the record.

Frequently asked questions

What is CVE-2026-52982?

It is a use-after-free (CWE-416) in the rtl8150 USB Ethernet driver of the Linux kernel. The transmit path reads a buffer length after the USB request may already have freed that buffer.

Is this vulnerability known to be exploited?

No. The CISA KEV catalogue does not list it, and no confirmed exploitation appears in the sources consulted.

How should administrators respond?

Update the kernel to a stable release that includes the upstream fix for the affected branch. If the rtl8150 driver is not needed, consider disabling it as a temporary measure.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.