Threats tagged 'ghsa-4c74-g9cq-vhc5'

CVE-2026-53025 is a use-after-free vulnerability in the Linux kernel's greybus raw driver. It occurs when a raw bundle disconnects while its character device (cdev) is still open by an application, leading to a kernel panic due to refcount underflow if init-on-free is enabled. The flaw arises because the cdev structure is freed during disconnect but later accessed when the application closes it. The fix involves embedding the device structure to align lifetimes and using cdev_device_add to manage references properly, deferring freeing to the device release function.