Skip to main content

Linux Kernel EUVDEUVD-2026-38986

| CVE-2026-53118 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-jmxg-xc7h-vhvv
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privileged access
  2. Delivery
    Interact with vDPA device sysfs
  3. Exploit
    Race driver_override write against driver match()
  4. Execution
    Trigger use-after-free of freed object
  5. Persist
    Reclaim and corrupt kernel slab memory
  6. Impact
    Escalate to kernel/root privileges

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local code execution on a host where the vDPA subsystem (vhost_vdpa/vdpa modules) is loaded and a vDPA device is present, plus the ability to write the driver_override sysfs attribute and trigger a driver-attach/match cycle to race the use-after-free. Limiting factors: the attack is local only (AV:L) - there is no remote or network path - it requires privileges sufficient to interact with vDPA sysfs (CVSS PR:L), success depends on winning a narrow timing race in __driver_attach()/match(), and hosts without the vDPA stack loaded (the common default for most non-virtualization workloads) are not exploitable at all.
Impact

The signals are internally consistent and point to moderate, local-only risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) requires local access and some privilege, which matches a UAF reachable through vDPA sysfs/device interaction rather than a remote attack. EPSS is very low (0.15%, 5th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis - all reinforcing that this is not under active exploitation. The primary caveat is exploitability: use-after-free bugs in the kernel are often difficult to weaponize reliably (race window, heap grooming, kernel hardening like KASLR/slab freelist randomization), so the 'HIGH' rating reflects worst-case impact rather than demonstrated ease of exploitation. There is no conflict between the sources; the main uncertainty is whether reaching the vulnerable path requires root-equivalent access to write driver_override, which would lower real-world risk further.
Exploit ScenarioDerived

A local user or a low-privileged process on a host that has the vDPA subsystem loaded races driver_override writes against the driver-probe match() path to trigger the use-after-free, then grooms the kernel slab to reclaim the freed object and corrupt adjacent kernel structures for privilege escalation. No public exploit is identified at time of analysis, and reliable exploitation requires winning a timing race and defeating kernel hardening.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Local privilege escalation and memory corruption in the Linux kernel's vDPA (virtio Data Path Acceleration) subsystem stems from an unlocked access to the driver_override field during device-to-driver matching, producing a use-after-free (CWE-416). Affected kernels from 5.17 up to the fixed 6.18.33, 7.0.10, and 7.1 releases allow a local user with the ability to interact with vDPA devices to corrupt kernel memory, with full confidentiality, integrity, and availability impact. EPSS is low (0.15%, 5th percentile) and there is no public exploit identified at time of analysis, so this is a patch-on-schedule kernel hardening fix rather than an emergency.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.18.33, 7.0.10, or 7.1 (or later) depending on your stable series; the upstream fixes are stable commits 85bb534ff12aab6916058897b39c748940a7a4c6, 654ef9c33e138ede6734ac286282df9faf83cd11, and fb5cb4913ce333cc4647722e8c2b8378e12f2464 available at git.kernel.org/stable. For distribution-managed systems, apply the packaged kernel updates and reboot, following Ubuntu USN-8568-1 and USN-8566-1 for affected Ubuntu releases. Where an immediate kernel update and reboot is not feasible, compensating controls are to avoid loading the vDPA stack (do not modprobe vhost_vdpa / vdpa and blacklist those modules) and to restrict access to vDPA device nodes and the driver_override sysfs attributes to root only - the trade-off is loss of vDPA/virtio acceleration functionality for any workloads that depend on it, so this is only appropriate on hosts that do not use vDPA.

Affected VersionsENISA

Linux 539fec78edb4e084e7c532affc56cc42d4ceea4b <85bb534ff12aab6916058897b39c748940a7a4c6
Linux patch: 0
Linux patch: 6.18.33
Linux 539fec78edb4e084e7c532affc56cc42d4ceea4b <654ef9c33e138ede6734ac286282df9faf83cd11
Linux patch: 7.0.10
Linux 539fec78edb4e084e7c532affc56cc42d4ceea4b <fb5cb4913ce333cc4647722e8c2b8378e12f2464
Linux 5.17
Linux patch: 7.1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

vDPA is a kernel framework that lets hardware or software devices expose a virtio-compatible data path to guests and userspace, and it uses a bus/driver model where devices can be steered to a specific driver via the sysfs driver_override attribute. When a driver is probed via __driver_attach(), the bus match() callback is invoked without the device lock held (an intentional design per the kernel maintainers), so reading driver_override directly races against concurrent writers that can free the underlying string. The fix replaces the ad-hoc driver_override handling with the driver-core generic driver_override infrastructure, which performs the required locking internally. The root cause is a classic CWE-416 use-after-free driven by missing synchronization on a lifetime-managed heap object, and the affected component is specifically the vDPA bus code in drivers/vhost/vdpa (cpe:2.3:a:linux:linux).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local only (AV:L) and needs privileged vDPA sysfs interaction (PR:L); AC:H because success depends on winning a driver-probe timing race, with full kernel memory impact (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 23, 2026 - 21:38 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

vdpa: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

Executive ViewAI

Why It Matters

The Linux kernel's vDPA (virtio Data Path Acceleration) subsystem contains a privilege escalation vulnerability affecting kernels 5.17 through 7.0.9, allowing local users to escalate privileges and compromise system confidentiality and integrity. Organizations operating Linux infrastructure in cloud platforms and virtualized environments should prioritize assessment and patching; however, the practical risk is limited to systems permitting untrusted local access, with no public exploit identified at time of analysis.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel runs on a huge fraction of servers and cloud hosts
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53118 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373465 REF https://git.kernel.org/stable/c/4005cb89139f7c9af85046b241dcf3fa2e1b3559 REF https://git.kernel.org/stable/c/4eab1a74a498f0bf19f102f9362e9deef9307aea REF https://git.kernel.org/stable/c/654ef9c33e138ede6734ac286282df9faf83cd11 REF https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6 REF https://git.kernel.org/stable/c/fb5cb4913ce333cc4647722e8c2b8378e12f2464

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy