{"id":"CVE-2026-53120","title":"PCI: use generic driver_override infrastructure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, th…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < fdfa287956d00b936e0ac409b21e4f90501ad109","Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < dfe950d9464cad609f3b118c6203e2708055bc61","Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < 58a42be0d70307d765594fc581f5f5e5ef059712","Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < c5b2c5755495507e14f310c2653c85de0a309b1f","Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < 10a4206a24013be4d558d476010cbf2eb4c9fa64","Linux 3.16"],"published":"2026-06-24","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:42:07.442Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53120","references":[{"url":"https://git.kernel.org/stable/c/fdfa287956d00b936e0ac409b21e4f90501ad109"},{"url":"https://git.kernel.org/stable/c/dfe950d9464cad609f3b118c6203e2708055bc61"},{"url":"https://git.kernel.org/stable/c/58a42be0d70307d765594fc581f5f5e5ef059712"},{"url":"https://git.kernel.org/stable/c/c5b2c5755495507e14f310c2653c85de0a309b1f"},{"url":"https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64"}],"tags":["cve.org"],"epss":0.00175,"epssPercentile":0.06647,"ingestedAt":"2026-10-21T12:48:53.621Z","slug":"CVE-2026-53120","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\n## Affected\n\n- `Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < fdfa287956d00b936e0ac409b21e4f90501ad109`\n- `Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < dfe950d9464cad609f3b118c6203e2708055bc61`\n- `Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < 58a42be0d70307d765594fc581f5f5e5ef059712`\n- `Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < c5b2c5755495507e14f310c2653c85de0a309b1f`\n- `Linux >= 782a985d7af26db39e86070d28f987cad21313c0 < 10a4206a24013be4d558d476010cbf2eb4c9fa64`\n- `Linux 3.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}