Linux Kernel CVE-2026-31527

Requires local authenticated access with low-privilege user credentials (PR:L from CVSS vector) on a Linux system running vulnerable kernel versions 3.17 through 7.0-rc4. Attacker must have ability to interact with the sysfs platform driver interface, specifically write access to /sys/bus/platform/drivers/*/driver_override attributes, which is typically available to unprivileged local users in default Linux configurations. Exploitation depends on winning a race condition between concurrent driver_override manipulation and platform device probing in __driver_attach(), requiring the ability to trigger device probe operations (via driver binding/unbinding mechanisms accessible through sysfs). No special kernel configuration or non-default features required beyond standard platform driver subsystem being compiled into the kernel (default in all major distributions). Limiting factors include: local-only attack vector (no remote network exploitation path), requirement for authenticated access (cannot be exploited pre-authentication), and timing precision needed to win the race condition (may require multiple exploitation attempts). Systems with restricted sysfs access via namespace isolation, SELinux/AppArmor policies blocking driver_override writes, or user namespaces with limited device access have reduced exposure but are not immune if attackers achieve sufficient local privilege.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) indicates local attack vector with low complexity requiring low privileges, yielding high impact across confidentiality, integrity, and availability. However, real-world exploitation risk appears significantly lower than the score suggests. EPSS 0.02% (5th percentile) shows minimal observed exploitation activity in the wild. No CISA KEV listing confirms this is not being actively exploited in targeted attacks. The local attack vector (AV:L) substantially reduces exposure compared to network-accessible vulnerabilities - exploitation requires existing authenticated access to the system. The low attack complexity (AC:L) and low privileges required (PR:L) are concerning from a post-compromise escalation perspective, but the need for local access limits initial attack surface. Patches are available across all active stable kernel branches (6.12.80, 6.18.21, 6.19.11, 7.0), indicating vendor responsiveness. SSVC analysis suggests defer priority for most organizations: exploitation is theoretical (no public POC identified), not automatable at scale (requires local access context), and patches exist. Priority should increase for high-security environments, container hosts, or multi-tenant systems where local privilege escalation poses greater risk. The vulnerability becomes concerning primarily in privilege escalation chains following initial compromise, not as a primary attack vector.

An attacker with low-privilege local access to a Linux system (such as a compromised web application service account or container escape) triggers a race condition by repeatedly manipulating the driver_override sysfs attribute while the platform driver core performs device probing. During the narrow window when __driver_attach() calls the bus match() callback without holding the device lock, the attacker frees the driver_override memory through a concurrent write operation, causing the match() function to reference freed memory (use-after-free). By controlling the freed memory contents through heap spraying or targeted allocation, the attacker redirects execution flow to achieve arbitrary kernel code execution with ring-0 privileges, enabling full system compromise, privilege escalation to root, persistence installation, or lateral movement to other systems. No public exploit code identified at time of analysis, but the low complexity (AC:L) suggests exploitation is feasible for skilled attackers once the race condition timing is mastered.