CVE-2026-53117
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel s390/cio subsystem, a vulnerability was found where the driver_override field was accessed without a lock, potentially causing a use-after-free (UAF). The fix uses the kernel's generic driver_override infrastructure with proper locking.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to kernel memory, potentially leading to privilege escalation or system instability.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit addressing the issue).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: s390/cio: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1]