VYPR
High severity7.8NVD Advisory· Published Jun 24, 2026· Updated Jul 23, 2026

CVE-2026-53119

CVE-2026-53119

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/wmi: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

Affected products

3
  • Linux/Kernel2 versions
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.11,<6.12.91
    • (no CPE)
  • osv-coords
    Range: >= 6.11.0, < 6.12.91

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.