APPLIED[N:hwe-6.17]: [SRU][Q][PATCH 0/1] CVE-2026-52982

[Edoardo Canepa]

Applied to n:linux/hwe-6.17-next. Thanks.

On 7/16/26 16:35, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-52982
>
> [ Impact ]
>
> A use-after-free flaw exists in the rtl8150 USB Ethernet driver in
> rtl8150_start_xmit(). After usb_submit_urb() is called, the URB may complete on
> another CPU in softirq context and free the skb via the write_bulk_callback()
> handler before the submitter reads skb->len for tx statistics. This results in
> a slab-use-after-free read, reported by syzbot via KASAN, which can lead to
> memory corruption or a crash.
>
> [ Fix ]
>
> questing: clean cherry-pick
> focal: backported with AI-assisted adaptation
> bionic: backported with AI-assisted adaptation
> xenial: backported with AI-assisted adaptation
> trusty: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix could affect tx statistics accounting or packet
> transmission in the rtl8150 USB Ethernet driver. Incorrect caching of the frame
> length could result in inaccurate tx_bytes counters for devices using this
> driver.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260730/5e237e20/attachment-0001.sig>