Skip to main content

Linux Kernel EUVDEUVD-2026-38986

| CVE-2026-53118 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-jmxg-xc7h-vhvv
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local only (AV:L) and needs privileged vDPA sysfs interaction (PR:L); AC:H because success depends on winning a driver-probe timing race, with full kernel memory impact (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:41 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

vdpa: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's vDPA (virtio Data Path Acceleration) subsystem stems from an unlocked access to the driver_override field during device-to-driver matching, producing a use-after-free (CWE-416). Affected kernels from 5.17 up to the fixed 6.18.33, 7.0.10, and 7.1 releases allow a local user with the ability to interact with vDPA devices to corrupt kernel memory, with full confidentiality, integrity, and availability impact. EPSS is low (0.15%, 5th percentile) and there is no public exploit identified at time of analysis, so this is a patch-on-schedule kernel hardening fix rather than an emergency.

Technical ContextAI

vDPA is a kernel framework that lets hardware or software devices expose a virtio-compatible data path to guests and userspace, and it uses a bus/driver model where devices can be steered to a specific driver via the sysfs driver_override attribute. When a driver is probed via __driver_attach(), the bus match() callback is invoked without the device lock held (an intentional design per the kernel maintainers), so reading driver_override directly races against concurrent writers that can free the underlying string. The fix replaces the ad-hoc driver_override handling with the driver-core generic driver_override infrastructure, which performs the required locking internally. The root cause is a classic CWE-416 use-after-free driven by missing synchronization on a lifetime-managed heap object, and the affected component is specifically the vDPA bus code in drivers/vhost/vdpa (cpe:2.3:a:linux:linux).

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.18.33, 7.0.10, or 7.1 (or later) depending on your stable series; the upstream fixes are stable commits 85bb534ff12aab6916058897b39c748940a7a4c6, 654ef9c33e138ede6734ac286282df9faf83cd11, and fb5cb4913ce333cc4647722e8c2b8378e12f2464 available at git.kernel.org/stable. For distribution-managed systems, apply the packaged kernel updates and reboot, following Ubuntu USN-8568-1 and USN-8566-1 for affected Ubuntu releases. Where an immediate kernel update and reboot is not feasible, compensating controls are to avoid loading the vDPA stack (do not modprobe vhost_vdpa / vdpa and blacklist those modules) and to restrict access to vDPA device nodes and the driver_override sysfs attributes to root only - the trade-off is loss of vDPA/virtio acceleration functionality for any workloads that depend on it, so this is only appropriate on hosts that do not use vDPA.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38986 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy