CVE-2026-53118: vdpa: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved:
vdpa: use generic driveroverride infrastructure
When a driver is probed through driverattach(), the bus' match() callback is called without the device lock held, thus accessing the driveroverride field without a lock, which can cause a UAF.
Fix this by using the driver-core driveroverride infrastructure taking care of proper locking internally.
Note that calling match() from driverattach() without the device lock held is intentional. [1]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the vdpa driver to use the generic driver-core driver_override infrastructure, ensuring the driver_override field is accessed with proper locking internally.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53118?
The severity of CVE-2026-53118 is rated at 40.
How do I fix CVE-2026-53118?
To fix CVE-2026-53118, ensure that you update to the latest version of the Linux kernel where the vulnerability has been resolved.
What systems are affected by CVE-2026-53118?
CVE-2026-53118 affects systems running the Linux kernel with vdpa support.
What type of vulnerability is CVE-2026-53118?
CVE-2026-53118 is a race condition vulnerability related to driver management in the Linux kernel.
When was CVE-2026-53118 published?
CVE-2026-53118 was published on June 24, 2026.