Executive brief
A vulnerability was identified in the Linux kernel's Windows Management Instrumentation (WMI) subsystem, which handles communication between the OS and hardware BIOS. A technical flaw in how the system matches drivers to devices could lead to a system crash or unpredictable behavior. This issue has been resolved in recent kernel updates to ensure secure and stable hardware interaction.
Technical details
A use-after-free (UAF) vulnerability existed in the Linux kernel's WMI (Windows Management Instrumentation) subsystem. When a driver is probed via __driver_attach(), the bus's match() callback was being invoked without holding the device lock. This allowed the driver_override field to be accessed concurrently without synchronization, potentially leading to a UAF condition. The fix migrates the WMI subsystem to use the generic driver-core driver_override infrastructure, which handles the necessary locking internally. The vulnerability affected systems running Linux kernel versions starting from 6.11 where driver_override support was introduced for WMI.
Affected products
- Linux Linux Kernel 6.11 to 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-03-24: other: Patch authored
- 2026-06-24: advisory: CVE published