Skip to main content

Linux Kernel EUVDEUVD-2026-38988

| CVE-2026-53120 HIGH
Use After Free (CWE-416)
2026-06-24 Linux GHSA-95m4-5hjq-cmvv
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-priv shell
  2. Delivery
    Write PCI driver_override sysfs attribute
  3. Exploit
    Trigger concurrent driver rebind
  4. Execution
    Win race in unlocked match() read
  5. Persist
    Corrupt freed kernel memory
  6. Impact
    Escalate to kernel privileges

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local access with at least low privileges (PR:L) - the attacker needs the ability to interact with the PCI driver_override interface and to induce driver probe/bind operations via __driver_attach(). The exploitable window exists only because match() is called without the device lock during driver attach; exploitation is limited by the need to win a narrow timing race between the unlocked read of driver_override and a concurrent free, and by requiring write access to the driver_override sysfs attribute or an equivalent trigger. It is not remotely exploitable (AV:L) and requires no user interaction, but is confined to hosts where untrusted local users can reach PCI driver-binding sysfs controls.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) indicates a local, low-complexity, low-privilege issue with high impact to confidentiality, integrity and availability - the standard scoring template for kernel memory-corruption bugs. However, real-world priority is tempered: EPSS is only 0.16% (5th percentile), there is no KEV listing and no public POC, and the underlying defect is a race condition, which typically raises practical exploitation difficulty above what AC:L suggests. The signals are internally consistent (local vector, low EPSS, no active exploitation) and point to a genuine but low-urgency issue for most environments; prioritize on multi-tenant or untrusted-local-user hosts where local attackers exist. Note: the CVSS AC:L rating arguably understates the timing/race requirement to win the UAF window - verify against workload exposure.
Exploit ScenarioDerived

A local low-privileged user on a shared Linux host repeatedly writes to a PCI device's driver_override sysfs attribute while concurrently triggering driver (re)binding, racing to free the driver_override string during the unlocked match() read. Winning the race corrupts freed kernel memory, which a skilled attacker can shape toward privilege escalation. No public exploit is currently available, and reliable exploitation requires precise timing of the race window.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Use-after-free in the Linux kernel PCI subsystem allows a local low-privileged attacker to corrupt memory by racing driver probe operations that access the driver_override field without holding the device lock. The flaw stems from __driver_attach() invoking the bus match() callback without the device lock, exposing an unlocked read of driver_override; exploitation could lead to memory corruption and privilege escalation. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 5th percentile), consistent with a hard-to-trigger local race rather than a widely-weaponized bug.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable kernel - 6.12.91, 6.18.33, 7.0.10, or 7.1 or later depending on your series - which switches PCI to the locked generic driver_override infrastructure (upstream commits at https://git.kernel.org/stable/c/58a42be0d70307d765594fc581f5f5e5ef059712 and siblings). Ubuntu users should apply the kernel updates in USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1) and USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1) and reboot. If immediate patching is not possible, reduce exposure by restricting local shell access to trusted users and tightening permissions on the PCI driver_override sysfs attributes (under /sys/bus/pci/devices/*/driver_override) so unprivileged users cannot write them; note this only shrinks the attack surface and does not eliminate the race, and overly restrictive sysfs permissions can break legitimate device-management tooling.

Affected VersionsENISA

Linux patch: 7.1
Linux patch: 7.0.10
Linux patch: 0
Linux 782a985d7af26db39e86070d28f987cad21313c0 <c5b2c5755495507e14f310c2653c85de0a309b1f
Linux 782a985d7af26db39e86070d28f987cad21313c0 <dfe950d9464cad609f3b118c6203e2708055bc61
Linux 782a985d7af26db39e86070d28f987cad21313c0 <10a4206a24013be4d558d476010cbf2eb4c9fa64
Linux patch: 6.12.91
Linux patch: 6.18.33
Linux 782a985d7af26db39e86070d28f987cad21313c0 <58a42be0d70307d765594fc581f5f5e5ef059712
Linux 3.16

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the Linux kernel PCI bus driver-binding logic. When a driver binds via __driver_attach(), the bus' match() callback reads the per-device driver_override string, which controls forced driver-to-device binding. Because match() is intentionally called without the device lock held from this path, the ad-hoc PCI implementation read the driver_override pointer without synchronization, permitting a concurrent write (e.g., via the driver_override sysfs attribute) to free the string while it is being dereferenced - a classic CWE-416 use-after-free. The fix migrates PCI to the driver-core generic driver_override infrastructure, which performs proper internal locking around this field. The CPE data identifies the affected product broadly as cpe:2.3:a:linux:linux, i.e. the mainline/stable kernel tree.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local low-priv access to driver_override sysfs (AV:L/PR:L); AC:H because exploitation depends on winning a narrow timing race, with full kernel-memory impact (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 23, 2026 - 21:07 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

PCI: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

Executive ViewAI

Why It Matters

A high-severity Linux kernel privilege escalation vulnerability (CVE-2026-53120) could allow unprivileged system users to gain elevated access through a difficult-to-exploit race condition in PCI device management. Although exploitation is technically challenging and no active attacks have been detected, the potential for unauthorized privilege escalation poses a meaningful security risk to multi-user systems, warranting timely patching.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel runs on a vast fraction of servers, appliances, and devices
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53120 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373467 REF https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64 REF https://git.kernel.org/stable/c/58a42be0d70307d765594fc581f5f5e5ef059712 REF https://git.kernel.org/stable/c/c5b2c5755495507e14f310c2653c85de0a309b1f REF https://git.kernel.org/stable/c/dfe950d9464cad609f3b118c6203e2708055bc61 REF https://git.kernel.org/stable/c/fdfa287956d00b936e0ac409b21e4f90501ad109

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy