This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Analysis
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux Kernel | 99% |
|
||||||||||||||||
| Linux | Linux Kernel | 99% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Remediation
No vendor fix or workaround currently provided.
OpenCVE Recommended Actions
- Apply a kernel update that includes the driver_match_device_locked() fix from the maintainer commit
- For systems that cannot update immediately, prevent loading of bus drivers that rely on driver_override until the lock enforcement is in place
- Enable kernel lock debugging features such as CONFIG_PROVE_LOCKING or CONFIG_LOCKDEP to detect any race conditions during kernel operation
- Maintain a timely patch management process to apply the latest kernel releases and avoid known vulnerabilities
Generated by OpenCVE AI on May 6, 2026 at 20:38 UTC.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Thu, 18 Jun 2026 04:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: driver core: enforce device_lock for driver_match_device() Currently, driver_match_device() is called from three sites. One site (__device_attach_driver) holds device_lock(dev), but the other two (bind_store and __driver_attach) do not. This inconsistency means that bus match() callbacks are not guaranteed to be called with the lock held. Fix this by introducing driver_match_device_locked(), which guarantees holding the device lock using a scoped guard. Replace the unlocked calls in bind_store() and __driver_attach() with this new helper. Also add a lock assertion to driver_match_device() to enforce this guarantee. This consistency also fixes a known race condition. The driver_override implementation relies on the device_lock, so the missing lock led to the use-after-free (UAF) reported in Bugzilla for buses using this field. Stress testing the two newly locked paths for 24 hours with CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence and no lockdep warnings. | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| Title | driver core: enforce device_lock for driver_match_device() | kernel: driver core: enforce device_lock for driver_match_device() |
Wed, 06 May 2026 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-416 | |
| Metrics |
cvssV3_1
|
cvssV3_1
|
Tue, 28 Apr 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-413 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Mon, 27 Apr 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: driver core: enforce device_lock for driver_match_device() Currently, driver_match_device() is called from three sites. One site (__device_attach_driver) holds device_lock(dev), but the other two (bind_store and __driver_attach) do not. This inconsistency means that bus match() callbacks are not guaranteed to be called with the lock held. Fix this by introducing driver_match_device_locked(), which guarantees holding the device lock using a scoped guard. Replace the unlocked calls in bind_store() and __driver_attach() with this new helper. Also add a lock assertion to driver_match_device() to enforce this guarantee. This consistency also fixes a known race condition. The driver_override implementation relies on the device_lock, so the missing lock led to the use-after-free (UAF) reported in Bugzilla for buses using this field. Stress testing the two newly locked paths for 24 hours with CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence and no lockdep warnings. | |
| Title | driver core: enforce device_lock for driver_match_device() | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
MITRE
Status: REJECTED
Assigner: Linux
Published:
Updated: 2026-06-17T18:22:00.364Z
Reserved: 2026-03-09T15:48:24.131Z
Link: CVE-2026-31688
Vulnrichment
No data.
NVD
Status : Rejected
Published: 2026-04-27T18:16:54.287
Modified: 2026-06-17T19:17:19.300
Link: CVE-2026-31688
Redhat
OpenCVE Enrichment
Updated: 2026-05-06T20:45:05Z
Weaknesses
-
CWE-413
Improper Resource Locking