Skip to main content

Linux Kernel EUVDEUVD-2026-38987

| CVE-2026-53119 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-pjmw-5mrc-f36h
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local low-privilege access via WMI sysfs (AV:L/PR:L); AC:H because reliable exploitation requires winning an unlocked probe-vs-override race; UAF yields full kernel-memory impact (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:43 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

platform/wmi: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

AnalysisAI

Local privilege escalation via memory corruption in the Linux kernel's platform/x86 WMI subsystem arises from an unlocked access to the driver_override field during driver probing, producing a use-after-free (CWE-416). Authenticated local users on affected kernels (introduced around 6.11 and backported into stable trees) can trigger the race through the WMI bus to corrupt kernel memory, with high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and EPSS is low at 0.16% (5th percentile), indicating no observed weaponization.

Technical ContextAI

The flaw is in the Linux kernel WMI (Windows Management Instrumentation) platform driver (drivers/platform/x86/wmi.c). When a driver is probed through __driver_attach(), the bus match() callback is intentionally invoked WITHOUT holding the device lock. The WMI match logic read the driver_override sysfs string directly and without synchronization, so a concurrent userspace write to driver_override could free that string while match() was still dereferencing it - a classic use-after-free. The remediation replaces the hand-rolled handling with the driver-core generic driver_override infrastructure (driver_set_override() and shared helpers), which performs the required locking internally. CWE-416 here manifests as a race on a heap-allocated override string reachable from userspace via sysfs.

RemediationAI

Apply the fixed stable kernel from your distribution: the upstream fix is available as tagged stable commits (13d201bd840d2e2a645ef899f81342cd27ced346, 2c5507010fc3b8e2bd596c63c88f6ad39a69b1c4, 4dc755d86deed88789540d960e421124bad4c568, 8a700b1fc94df4d847a04f14ebc7f8532592b367) and in stable releases such as 6.12.91 and 6.18.33. Ubuntu users should install the fixed kernel packages from USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1) and reboot. If immediate patching is not possible, reduce exposure by unloading or blacklisting the wmi module (add 'blacklist wmi' via modprobe) on systems that do not need vendor WMI features - the trade-off is loss of WMI-backed functionality such as certain laptop hotkey, LED, thermal, and firmware-management interfaces - and restrict local shell access to trusted users, since exploitation requires local low-privilege access. No remote workaround is needed because the attack vector is local.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38987 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy