Linux Kernel EUVD-2026-24853

Exploitation requires local authenticated access (PR:L in CVSS) to write to sysfs driver_override node, a system with active SPI bus hardware or emulation, and precise timing to race the device probe operation. The vulnerability cannot be exploited remotely or by unauthenticated users. Systems without SPI subsystem compiled or with SPI drivers statically linked without hot-plug support are not vulnerable. The race window is inherently narrow and platform-dependent, requiring the attacker to repeatedly trigger device probe while manipulating driver_override, making reliable exploitation extremely difficult.

Real-world exploitation risk is low despite moderate CVSS score. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector requiring low privilege authentication and low complexity, but limited to local denial of service only - no confidentiality or integrity impact. The EPSS score of 0.02% at the 5th percentile strongly contradicts the CVSS rating, indicating security researchers assess actual exploitation probability as minimal. This discrepancy suggests the UAF condition requires precise timing or specific kernel configurations to trigger. No indicators confirm active exploitation (no KEV status, no POC identified). This is characteristic of memory safety issues that are difficult to weaponize reliably into consistent denial of service. Defense-in-depth through Linux distributions' standard security hardening (SMACK, SELinux, AppArmor) further constrains practical exploitation from low-privilege users.

A local low-privilege user on a system with SPI hardware monitors device bind/unbind operations through sysfs. By rapidly writing to the driver_override sysfs node while triggering device probe via hot-plug or module load, the attacker creates a race condition where __driver_attach() reads a freed driver_override pointer, causing a kernel panic (denial of service). The attack succeeds only if timing aligns precisely with the probe callback execution window, which is why exploitation is unreliable and rarely observed in practice.