Skip to main content

Linux Kernel CVE-2026-53115

| EUVDEUVD-2026-38983 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-fwhp-9prf-4wq9
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain low-privileged local shell on DPAA2 host
  2. Delivery
    Write to fsl-mc driver_override sysfs attribute
  3. Exploit
    Race concurrent driver probe via __driver_attach()
  4. Execution
    Trigger use-after-free in bus match()
  5. Persist
    Groom kernel heap to reoccupy freed string
  6. Impact
    Corrupt kernel memory for privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local access with a low-privileged account (CVSS PR:L, AV:L) on a system that actually instantiates the fsl-mc bus - i.e., Linux running on NXP/Freescale Management Complex (DPAA2) hardware such as Layerscape SoCs - because the vulnerable match()/driver_override code only executes there. The concrete trigger is concurrent access to the fsl-mc driver_override field: the attacker must race a sysfs write to driver_override against a driver probe through __driver_attach(), where match() is intentionally called without the device lock. Limiting factors: no exploitation is possible on kernels/hardware without the fsl-mc bus, exploitation needs local (not remote) access, and reliable privilege escalation additionally requires winning a timing race and kernel heap grooming rather than a single deterministic step.
Impact

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, HIGH) describes a local, low-complexity, low-privilege attack with no user interaction and high impact across C/I/A - consistent with a kernel memory-corruption UAF that can yield privilege escalation or a crash. Real-world risk is tempered: EPSS is only 0.16% (5th percentile), the CVE is NOT in CISA KEV, and no public exploit has been identified, so this is not evidence of active or widespread exploitation. A meaningful limiting factor absent from the CVSS score is hardware scope - fsl-mc only loads on systems with an NXP DPAA2/Management Complex bus (Layerscape platforms), so the vast majority of Linux deployments never instantiate the vulnerable code path. Signals are therefore consistent rather than conflicting: high CVSS severity for the narrow population that runs this driver, but low exploitation probability and no KEV, indicating a low operational priority for general fleets and a moderate one for NXP DPAA2/embedded/networking gear.
Exploit ScenarioDerived

A local attacker with a low-privileged account on an NXP Layerscape/DPAA2 system races writes to a device's driver_override sysfs attribute against a driver (re)probe that triggers the fsl-mc bus match() callback, causing the callback to read freed memory. By grooming kernel heap allocations to reoccupy the freed driver_override string, the attacker turns the use-after-free into kernel memory corruption for privilege escalation or a denial-of-service crash. No public proof-of-concept exploit has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Local privilege escalation via a use-after-free in the Linux kernel's fsl-mc bus driver (drivers/bus/fsl-mc) allows a low-privileged local attacker to corrupt kernel memory when the bus match() callback accesses the unlocked driver_override field during __driver_attach() probing. The flaw affects NXP/Freescale Management Complex bus code and is fixed by switching to the driver-core's generic driver_override infrastructure that locks internally. No public exploit identified at time of analysis and EPSS is low (0.16%), but the CVSS 7.8 high severity reflects full confidentiality, integrity, and availability impact on a successful local attack.

RemediationAI

Apply the vendor kernel update as the primary fix: upgrade to a patched stable release - 6.12.91, 6.18.33, 7.0.10, or 7.1 or later - per the kernel.org stable commits (https://git.kernel.org/stable/c/4911b836f35c034c36f102db4ecbe339b38e7d1d and the related 8139ce66..., 60bfb563..., 6c8dfb03... commits). Distribution users should install the corresponding fixed packages via Ubuntu USN-8566-1, USN-8567-1, and USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) or their distro's equivalent advisory and reboot. Where immediate patching is not possible, compensating controls include restricting local shell and sysfs access to trusted operators and, on systems that do not require NXP DPAA2/Management Complex hardware, not loading the fsl_mc_bus module (blacklist it), which removes the vulnerable code path entirely; the trade-off is loss of DPAA2 device management, so this is only viable on platforms that do not depend on that bus. Tightening permissions on the driver_override sysfs attributes limits who can trigger the race but does not fully eliminate it.

Affected VersionsENISA

Linux patch: 0
Linux patch: 6.12.91
Linux patch: 7.0.10
Linux 1f86a00c1159fd77e66b1bd6ff1a183f4d46f34d <6c8dfb0362732bf1e4829867a2a5239fedc592d0
Linux 1f86a00c1159fd77e66b1bd6ff1a183f4d46f34d <8139ce66b52a4a5638bfb445b037c07d4abeb08e
Linux patch: 7.1
Linux patch: 6.18.33
Linux 5.10
Linux 1f86a00c1159fd77e66b1bd6ff1a183f4d46f34d <4911b836f35c034c36f102db4ecbe339b38e7d1d
Linux 1f86a00c1159fd77e66b1bd6ff1a183f4d46f34d <60bfb563a399c4597dc80588a1109758a8908b97

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the fsl-mc (Freescale/NXP Management Complex) bus driver in the Linux kernel, which enumerates DPAA2 objects on NXP Layerscape SoCs. The root cause is CWE-416 (Use After Free): when a driver is probed via __driver_attach(), the bus' match() callback is intentionally invoked without holding the device lock, yet the old code read the driver_override string field without any synchronization. Because driver_override can be written concurrently (via sysfs), an unlocked read against a freed/reallocated string produces a use-after-free. The fix removes the custom driver_override handling and adopts the driver-core's generic driver_override infrastructure (driver_set_override / driver_override sysfs helpers), which performs the required locking internally, eliminating the race without changing the intentional lockless match() call path.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local low-priv attacker exploiting a driver_override race, so AV:L/PR:L; winning the timing race raises AC:H; UAF can yield full C/I/A kernel impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 23, 2026 - 21:38 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bus: fsl-mc: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

Executive ViewAI

Why It Matters

CVE-2026-53115 is a high-severity local privilege escalation in the Linux kernel's fsl-mc driver affecting systems with NXP/Freescale Management Complex hardware. The vulnerability allows low-privileged local users to corrupt kernel memory and escalate privileges, creating significant insider threat risk in multi-tenant environments and shared infrastructure deployments.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Low
fsl-mc bus only loads on NXP DPAA2/Layerscape hardware, niche embedded footprint
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53115 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373463 REF https://git.kernel.org/stable/c/4911b836f35c034c36f102db4ecbe339b38e7d1d REF https://git.kernel.org/stable/c/60bfb563a399c4597dc80588a1109758a8908b97 REF https://git.kernel.org/stable/c/6c8dfb0362732bf1e4829867a2a5239fedc592d0 REF https://git.kernel.org/stable/c/8139ce66b52a4a5638bfb445b037c07d4abeb08e REF https://git.kernel.org/stable/c/dbba371b19129abe9649553ab912e6bccf6c1a5b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy