CVE-2026-53118

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53118.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

539fec78edb4e084e7c532affc56cc42d4ceea4b

Fixed

4005cb89139f7c9af85046b241dcf3fa2e1b3559

Fixed

4eab1a74a498f0bf19f102f9362e9deef9307aea

Fixed

654ef9c33e138ede6734ac286282df9faf83cd11

Fixed

fb5cb4913ce333cc4647722e8c2b8378e12f2464

Fixed

85bb534ff12aab6916058897b39c748940a7a4c6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53118.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.17.0

Fixed

6.6.160

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.114

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.33

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.0.10

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53118.json"