CVE-2026-53115
Low risk· EPSS 5%Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel, a vulnerability was found in the fsl-mc bus driver where the match() function is called without holding the device lock, allowing access to the driver_override field without synchronization and leading to a use-after-free (UAF). The fix uses the generic driver_override infrastructure from the kernel core, which ensures proper locking.
Risk Assessment
An attacker could exploit this vulnerability to access freed memory, potentially leading to privilege escalation or system crash.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit addressing the issue).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1]