Skip to main content

Linux Kernel CVE-2026-53120

| EUVDEUVD-2026-38988 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-95m4-5hjq-cmvv
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-priv access to driver_override sysfs (AV:L/PR:L); AC:H because exploitation depends on winning a narrow timing race, with full kernel-memory impact (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:09 vuln.today
CVSS changed
Jul 23, 2026 - 21:07 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

PCI: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

AnalysisAI

Use-after-free in the Linux kernel PCI subsystem allows a local low-privileged attacker to corrupt memory by racing driver probe operations that access the driver_override field without holding the device lock. The flaw stems from __driver_attach() invoking the bus match() callback without the device lock, exposing an unlocked read of driver_override; exploitation could lead to memory corruption and privilege escalation. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 5th percentile), consistent with a hard-to-trigger local race rather than a widely-weaponized bug.

Technical ContextAI

The affected component is the Linux kernel PCI bus driver-binding logic. When a driver binds via __driver_attach(), the bus' match() callback reads the per-device driver_override string, which controls forced driver-to-device binding. Because match() is intentionally called without the device lock held from this path, the ad-hoc PCI implementation read the driver_override pointer without synchronization, permitting a concurrent write (e.g., via the driver_override sysfs attribute) to free the string while it is being dereferenced - a classic CWE-416 use-after-free. The fix migrates PCI to the driver-core generic driver_override infrastructure, which performs proper internal locking around this field. The CPE data identifies the affected product broadly as cpe:2.3:a:linux:linux, i.e. the mainline/stable kernel tree.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable kernel - 6.12.91, 6.18.33, 7.0.10, or 7.1 or later depending on your series - which switches PCI to the locked generic driver_override infrastructure (upstream commits at https://git.kernel.org/stable/c/58a42be0d70307d765594fc581f5f5e5ef059712 and siblings). Ubuntu users should apply the kernel updates in USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1) and reboot. If immediate patching is not possible, reduce exposure by restricting local shell access to trusted users and tightening permissions on the PCI driver_override sysfs attributes (under /sys/bus/pci/devices/*/driver_override) so unprivileged users cannot write them; note this only shrinks the attack surface and does not eliminate the race, and overly restrictive sysfs permissions can break legitimate device-management tooling.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53120 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy