{"id":"CVE-2026-53118","title":"vdpa: use generic driver_override infrastructure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, t…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < 4005cb89139f7c9af85046b241dcf3fa2e1b3559","Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < 4eab1a74a498f0bf19f102f9362e9deef9307aea","Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < 654ef9c33e138ede6734ac286282df9faf83cd11","Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < fb5cb4913ce333cc4647722e8c2b8378e12f2464","Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < 85bb534ff12aab6916058897b39c748940a7a4c6","Linux 5.17"],"published":"2026-06-24","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:42:06.359Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53118","references":[{"url":"https://git.kernel.org/stable/c/4005cb89139f7c9af85046b241dcf3fa2e1b3559"},{"url":"https://git.kernel.org/stable/c/4eab1a74a498f0bf19f102f9362e9deef9307aea"},{"url":"https://git.kernel.org/stable/c/654ef9c33e138ede6734ac286282df9faf83cd11"},{"url":"https://git.kernel.org/stable/c/fb5cb4913ce333cc4647722e8c2b8378e12f2464"},{"url":"https://git.kernel.org/stable/c/85bb534ff12aab6916058897b39c748940a7a4c6"}],"tags":["cve.org"],"epss":0.00119,"epssPercentile":0.01648,"ingestedAt":"2026-10-21T12:48:53.620Z","slug":"CVE-2026-53118","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\n## Affected\n\n- `Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < 4005cb89139f7c9af85046b241dcf3fa2e1b3559`\n- `Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < 4eab1a74a498f0bf19f102f9362e9deef9307aea`\n- `Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < 654ef9c33e138ede6734ac286282df9faf83cd11`\n- `Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < fb5cb4913ce333cc4647722e8c2b8378e12f2464`\n- `Linux >= 539fec78edb4e084e7c532affc56cc42d4ceea4b < 85bb534ff12aab6916058897b39c748940a7a4c6`\n- `Linux 5.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}