Executive brief
A vulnerability in the Linux kernel's driver core could allow a local user to cause a system crash or potentially execute unauthorized code. The issue stems from how the system manages hardware drivers, specifically failing to properly lock certain data while it is being accessed. This could lead to a 'use-after-free' scenario where the system tries to use memory that has already been released, impacting the overall stability and security of the operating system.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel driver core due to inconsistent locking in driver_match_device(). While __device_attach_driver holds the necessary device_lock, other call sites such as bind_store and __driver_attach do not. This inconsistency allows bus match() callbacks to be executed without the lock, creating a race condition in the driver_override implementation. An attacker with local access could exploit this race to trigger a UAF, potentially leading to local privilege escalation or a kernel panic. The issue was resolved by introducing driver_match_device_locked() to ensure the device lock is held via a scoped guard and adding lock assertions.
Affected products
- Linux Linux Kernel 2.6.30 to 7.0 (exclusive)
Timeline
- 2026-04-27: disclosed
- 2026-06-17: other: CVE was rejected/withdrawn by the CNA after initial publication