CVE-2026-53119
Low risk· EPSS 5%Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability was found in the Linux kernel's platform/wmi subsystem where the driver_override field was accessed without a lock during the match() call in driver probing, potentially leading to a use-after-free (UAF).
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to kernel memory, potentially leading to privilege escalation or system instability.
Recommendation
It is recommended to immediately update the Linux kernel to a version containing the fix that uses the generic driver_override infrastructure with proper locking.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: platform/wmi: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1]