Executive brief
The Linux kernel's Hyper-V vmbus driver had an unsafe access to the driver_override field when matching drivers during device probe. This could cause a use-after-free condition, potentially allowing a local attacker to trigger a kernel crash or gain elevated privileges on systems running Hyper-V virtual machines.
Technical details
The vulnerability is a use-after-free (UAF) in the Hyper-V vmbus driver's match callback. When __driver_attach() invokes the bus' match() function, it does so without holding the device lock. The vmbus match code directly accessed the driver_override field without synchronization, creating a race condition. An attacker with local access could free or modify this field during the match operation. The fix replaces the custom driver_override implementation with the generic driver-core infrastructure, which includes proper internal locking to serialize access.
Affected products
- Linux Linux kernel multiple versions (see kernel.org stable tree branches)
Timeline
- 2026-08-28: disclosed
- 2026-05-05: patched: Upstream fix commit 331d8900121a1d74ecd45cd2db742ddcb5a0a565