# CVE-2026-53025: greybus: raw: fix use-after-free on cdev close

CVE-2026-53025 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-53025, released June 25, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-53025
- Priority: Urgent
- CVSS: 9.8 (Critical)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 24, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53025

## Description

In the Linux kernel, the following vulnerability has been resolved:  greybus: raw: fix use-after-free on cdev close  This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):          refcount_t: underflow; use-after-free.         WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130          ...         Call Trace:          <TASK>          cdev_put+0x18/0x30          __fput+0x255/0x2a0          __x64_sys_close+0x3d/0x80          do_syscall_64+0xa4/0x290          entry_SYSCALL_64_after_hwframe+0x77/0x7f  The cdev is contained in the "gb_raw" structure, which is freed in the disconnect operation. When the cdev is released at a later time, cdev_put gets an address that points to freed memory.  To fix this use-after-free, convert the struct device from a pointer to being embedded, that makes the lifetime of the cdev and of this device the same. Then, use cdev_device_add, which guarantees that the device won't be released until all references to the cdev have been released. Finally, delegate the freeing of the structure to the device release function, instead of freeing immediately in the disconnect callback.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-53025](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53025.md) | Jun 25, 2026 |
| Linux | linux Debian 14 | 7.0.10-1 | [DEBIAN-CVE-2026-53025](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53025.md) | Jun 25, 2026 |

---

Data as of 2026-11-09T19:38:12Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.