CVE-2026-90029

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the realtek cr USB storage component. The realtek cr destructor() function calls timer delete() before the chip containing the timer is freed. This allows the timer callback to continue running and potentially rearm itself, leading to a use-after-free condition.

Recommendations Update the Linux kernel to a version where the realtek cr destructor() function uses timer shutdown sync() to wait for the callback and prevent rearming, and ensure timer setup() is moved into init realtek cr().