Executive brief
A use-after-free (UAF) vulnerability exists in the Linux kernel's PCI driver subsystem when device probing runs concurrently with removal of dynamically added device IDs. An attacker with local access could trigger this race condition to cause a kernel crash or potentially execute arbitrary code, disrupting system stability.
Technical details
The vulnerability is a use-after-free (UAF) race condition in the pci_match_device() function. When dynamic PCI device IDs are added via sysfs, they are stored in a linked list protected by a spinlock. The remove_id_store() function can free these nodes while pci_match_device() is still referencing them outside the lock, causing the probe path to dereference freed memory. The fix copies the dynamic ID into a local buffer while holding the spinlock, eliminating the UAF window. This vulnerability is triggered when device probing and dynamic ID removal happen concurrently, requiring no special privileges beyond local system access.
Affected products
- Linux Linux kernel before fix (affects multiple stable series from 2.6.11 through 7.2)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-07-28: patched: Upstream fix committed by Bjorn Helgaas
- 2026-07-23: other: Patch authored by Gary Guo