Skip to main content

Linux Kernel EUVDEUVD-2026-38985

| CVE-2026-53117 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-w826-vj56-vqh9
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access on s390 host
  2. Delivery
    Write device driver_override via sysfs
  3. Exploit
    Race probe with concurrent match() read
  4. Execution
    Trigger use-after-free in cio
  5. Impact
    Corrupt kernel memory for escalation/crash

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target to be running Linux on the s390 (IBM Z mainframe) architecture, because the vulnerable code is in the s390/cio channel-I/O subsystem; systems on x86, ARM, or other architectures are not affected. The attacker must have local access and the ability to interact with the driver/device binding machinery - specifically to write the driver_override sysfs attribute and induce a driver probe via __driver_attach() - and must win a timing race, since the bug is a race-condition use-after-free rather than a deterministic primitive. Limiting factors: architecture is s390-only, access is local (AV:L, no remote path), and driver_override sysfs writes are normally root-restricted, so realistic exploitation depends on privileged local access plus reliable race-window control.
Impact

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) reflects a local, low-complexity, low-privilege attacker with high CIA impact - the standard rating template for kernel UAFs. However, several signals argue this is lower real-world priority than the 7.8 suggests: EPSS is 0.17% (7th percentile), it is not in CISA KEV, and no POC is referenced. Critically, driver_override is written through sysfs that is normally root-writable, and triggering the flaw depends on a probe-time race, so realistic exploitation likely needs elevated privileges and precise timing rather than trivial low-priv access - I assess AC and PR as higher than the input vector states (see assessed vectors). The affected code path is s390-only, dramatically narrowing the exposed population regardless of severity. Net: legitimate to patch, but not an emergency for the vast majority of Linux deployments.
Exploit ScenarioDerived

On an IBM Z (s390) Linux system, a local attacker who can influence driver binding races a write to a device's driver_override attribute against a driver probe path so that the bus match() callback reads the driver_override string after it has been freed, corrupting kernel memory. With careful heap grooming this use-after-free could be steered toward privilege escalation or a kernel crash. No public exploit code is currently identified for this issue.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Local privilege-relevant memory corruption in the Linux kernel's s390 channel-I/O (cio) subsystem allows a use-after-free when a device driver is probed via __driver_attach() and the bus match() callback reads the unprotected driver_override field. The flaw affects Linux on IBM Z (s390) mainframes and is resolved by switching to the driver-core's generic driver_override infrastructure, which handles locking internally. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1 or later - or apply your distribution's backport (Ubuntu users should install the kernels in USN-8566-1, USN-8567-1, and USN-8568-1 via a full apt upgrade and reboot). Non-Ubuntu users should track their distributor's advisory referencing the listed stable commits. Because the vulnerable code compiles and executes only on s390, systems on other architectures are not exposed and can deprioritize. Where immediate patching is not possible on IBM Z hosts, restrict local and root access to the machine and avoid handing out privileges that permit writing driver_override sysfs attributes or driving repeated driver (re)binding, since the trigger requires interacting with the channel-I/O device/driver binding path; note this only reduces, not eliminates, exposure to a local privileged actor.

Affected VersionsENISA

Linux patch: 6.6.141
Linux patch: 6.18.33
Linux ebc3d179150347f3b6d97d8f249378bb2218f95e <106d594711e97762788046c5bbb94f580abc4bf4
Linux patch: 7.0.10
Linux ebc3d179150347f3b6d97d8f249378bb2218f95e <b660ba045b2b22cf3b4be72773de00cb48f47be5
Linux ebc3d179150347f3b6d97d8f249378bb2218f95e <c4295487124f461405e1ef64dfa8c4ab0cb7ebcf
Linux 5.3
Linux patch: 0
Linux patch: 6.12.91
Linux ebc3d179150347f3b6d97d8f249378bb2218f95e <ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4
Linux patch: 7.1
Linux ebc3d179150347f3b6d97d8f249378bb2218f95e <2081957d8c323ffb58a10bc64837717ac5a042a1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the s390 common I/O layer (drivers/s390/cio), the kernel subsystem that manages channel subsystem devices on IBM Z mainframes. The driver_override sysfs attribute lets an administrator force a device to bind to a specific driver. The root cause is CWE-416 (Use-After-Free): the bus match() callback is invoked from __driver_attach() without the device lock held, so it reads driver_override concurrently with a write/free of that string, producing a race that can dereference freed memory. The fix adopts the generic driver-core driver_override helpers (driver_set_override / device_show/store) that serialize access with proper internal locking, rather than the subsystem's ad-hoc handling.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.4 MEDIUM

Local only (AV:L); requires winning a probe-time race (AC:H) and privileged access to write driver_override sysfs (PR:H); UAF can yield full kernel-memory compromise (C/I/A:H).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 23, 2026 - 21:38 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

s390/cio: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

Executive ViewAI

Why It Matters

A privilege escalation vulnerability in the Linux kernel affects IBM Z mainframe systems, which often host critical business applications and infrastructure. Organizations operating IBM Z systems should assess their exposure and apply available vendor patches promptly.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Low
Linux is ubiquitous but this flaw is reachable only on niche s390 mainframes
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53117 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373464 REF https://git.kernel.org/stable/c/106d594711e97762788046c5bbb94f580abc4bf4 REF https://git.kernel.org/stable/c/2081957d8c323ffb58a10bc64837717ac5a042a1 REF https://git.kernel.org/stable/c/ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4 REF https://git.kernel.org/stable/c/b660ba045b2b22cf3b4be72773de00cb48f47be5 REF https://git.kernel.org/stable/c/c4295487124f461405e1ef64dfa8c4ab0cb7ebcf

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy