CVE-2026-31527
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
41/100
Published: 2026-04-22
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: driver core: platform: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1]
Weakness Classification (1)
Affected Software (11)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | 3d713e0e382e6fcfb4bba1501645b66c129ad60b < 492349e5e4a369a8b62781100a3ade470bf1ce6b |
| Linux | Linux | 3d713e0e382e6fcfb4bba1501645b66c129ad60b < 9a6086d2a828dd2ff74cf9abcae456670febd71f |
| Linux | Linux | 3d713e0e382e6fcfb4bba1501645b66c129ad60b < 7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1 |
| Linux | Linux | 3d713e0e382e6fcfb4bba1501645b66c129ad60b < edee7ee5a14c3b33f6d54641f5af5c5e9180992d |
| Linux | Linux | 3d713e0e382e6fcfb4bba1501645b66c129ad60b < 2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d |
| Linux | Linux | 3.17 |
| linux | linux_kernel | 3.17 – 6.12.80 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |