Linux Kernel vdpa UAF from driver_override lock omission
CVE-2026-53118 Published on June 24, 2026
vdpa: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved:
vdpa: use generic driver_override infrastructure
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
Products Associated with CVE-2026-53118
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version 539fec78edb4e084e7c532affc56cc42d4ceea4b and below 654ef9c33e138ede6734ac286282df9faf83cd11 is affected.
- Version 539fec78edb4e084e7c532affc56cc42d4ceea4b and below fb5cb4913ce333cc4647722e8c2b8378e12f2464 is affected.
- Version 539fec78edb4e084e7c532affc56cc42d4ceea4b and below 85bb534ff12aab6916058897b39c748940a7a4c6 is affected.
- Version 5.17 is affected.
- Before 5.17 is unaffected.
- Version 6.18.33, <= 6.18.* is unaffected.
- Version 7.0.10, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.