CVE-2026-53118

vdpa: use generic driver_override infrastructure

Published Jun 24, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

vdpa: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]

Analysis

Technical impact

A race condition in the Linux vdpa driver allows the bus match callback to read the driver_override field without holding the device lock. This unsynchronized access can trigger a use‑after‑free, corrupting kernel memory and potentially enabling an attacker to execute arbitrary code with kernel privileges. This vulnerability corresponds to a use‑after‑free condition (CWE‑416).

Affected Systems

All Linux kernel builds that contain the vdpa driver and have not applied the patch that redirects driver_override accesses to the driver‑core infrastructure. No specific kernel release numbers are provided; affected systems remain vulnerable until the patch from commit 654ef9c33e… is incorporated.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, and the EPSS score of less than 1% suggests a low but non‑zero exploitation probability. KEV has not listed this vulnerability, so there is no public catalog of known exploits. A kernel‑level use‑after‑free of this nature can permit local privilege escalation if an attacker can influence device probing or memory layout, so systems lacking the fix are considered at high risk until the kernel is updated.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`539fec78edb4e084e7c532affc56cc42d4ceea4b`	affected	< 4005cb89139f7c9af85046b241dcf3fa2e1b3559
`539fec78edb4e084e7c532affc56cc42d4ceea4b`	affected	< 4eab1a74a498f0bf19f102f9362e9deef9307aea
`539fec78edb4e084e7c532affc56cc42d4ceea4b`	affected	< 654ef9c33e138ede6734ac286282df9faf83cd11
`539fec78edb4e084e7c532affc56cc42d4ceea4b`	affected	< fb5cb4913ce333cc4647722e8c2b8378e12f2464
`539fec78edb4e084e7c532affc56cc42d4ceea4b`	affected	< 85bb534ff12aab6916058897b39c748940a7a4c6

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[539fec78edb4e084e7c532affc56cc42d4ceea4b,654ef9c33e138ede6734ac286282df9faf83cd11)`	affected	code_commit	—
`[539fec78edb4e084e7c532affc56cc42d4ceea4b,fb5cb4913ce333cc4647722e8c2b8378e12f2464)`	affected	code_commit	—
`[539fec78edb4e084e7c532affc56cc42d4ceea4b,85bb534ff12aab6916058897b39c748940a7a4c6)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	generic	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that includes the driver‑override fix introduced by commit 654ef9c33e…
Reboot the system to load the updated kernel
If an immediate kernel upgrade is not possible, disable the vdpa driver by removing it from the kernel configuration or unbinding any running virtual devices to prevent the problematic driver from being probed until the fix is available.

Generated by OpenCVE AI on August 12, 2026 at 07:18 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4904-1	linux-6.12 security update
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.120% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/4005cb89139f7c9af85046b241dcf3fa2e1b3559
https://git.kernel.org/stable/c/4eab1a74a498f0bf19f102f9362e9deef9307aea
https://git.kernel.org/stable/c/654ef9c33e138ede6734ac286282df9faf83cd11
https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6
https://git.kernel.org/stable/c/fb5cb4913ce333cc4647722e8c2b8378e12f2464
https://lore.kernel.org/linux-cve-announce/2026062415-CVE-2026-53118-a02a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53118
https://www.cve.org/CVERecord?id=CVE-2026-53118

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4005cb89139f7c9af85046b241dcf3fa2e1b3559 https://git.kernel.org/stable/c/4eab1a74a498f0bf19f102f9362e9deef9307aea

Jun 26, 2026 3:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Jun 26, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-413
References		https://lore.kernel.org/linux-cve-announce/2026062415-CVE-2026-53118-a02a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53118 https://www.cve.org/CVERecord?id=CVE-2026-53118
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jun 24, 2026 9:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Jun 24, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vdpa: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1]
Title		vdpa: use generic driver_override infrastructure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/654ef9c33e138ede6734ac286282df9faf83cd11 https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6 https://git.kernel.org/stable/c/fb5cb4913ce333cc4647722e8c2b8378e12f2464