Executive brief
A vulnerability was identified in the Linux kernel's driver management system. This flaw could allow a local user to cause a system crash or potentially execute unauthorized actions by exploiting a memory management error during the process of connecting hardware drivers to devices. This affects the stability and security of the operating system on various hardware platforms.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's driver core, specifically within the platform bus implementation. When a driver is probed via __driver_attach(), the bus' match() callback is invoked without holding the device lock. This allows concurrent access to the driver_override field without synchronization, leading to a race condition and subsequent UAF. The fix migrates the platform bus to the generic driver_override infrastructure which handles the necessary locking internally. This issue was introduced in the 'driver_override' binding path and affects multiple kernel versions. Patching is available in stable branches including 6.12.80, 6.18.21, and 6.19.11.
Affected products
- Linux Linux Kernel 3.17 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-03: other: Patch authored
- 2026-04-22: disclosed: Initial disclosure date
- 2026-04-22: advisory
- 2026-06-01: patched: Final patch commits integrated into stable branches
References
- https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d
- https://git.kernel.org/stable/c/492349e5e4a369a8b62781100a3ade470bf1ce6b
- https://git.kernel.org/stable/c/7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1
- https://git.kernel.org/stable/c/9a6086d2a828dd2ff74cf9abcae456670febd71f
- https://git.kernel.org/stable/c/edee7ee5a14c3b33f6d54641f5af5c5e9180992d