Executive brief
The Linux kernel's device driver core has a race condition in the function that checks whether a device driver supports synchronization state callbacks. Without proper locking, a device being unbound concurrently could cause the function to access freed memory, leading to a kernel crash or potential privilege escalation on systems where driver unbinding can be triggered by unprivileged users.
Technical details
The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU) race condition in the dev_has_sync_state() function within the Linux kernel's driver core. The function reads the dev->driver pointer twice without holding the device_lock()—once to check if it is NULL and again to dereference the sync_state field. Some callers hold only device_links_write_lock, which does not prevent concurrent device unbind operations via device_unbind_cleanup() from clearing dev->driver between these two reads. This can result in dereferencing a freed or invalid pointer. The fix uses READ_ONCE() to ensure the pointer is read exactly once with proper memory semantics, paired with WRITE_ONCE() in device_set_driver(). An attacker with local access and capability to trigger device unbinding could exploit this to cause a kernel panic or potentially achieve privilege escalation.
Affected products
- Linux Linux kernel Linux 5.0 and later
Timeline
- 2026-04-18: other: Patch authored by Danilo Krummrich
- 2026-07-24: patched: Fix merged into stable Linux kernel branches