CVE-2026-53117: Linux s390 Kernel Use-After-Free in Driver Override—Local Privilege Escalation

Technical summary

The s390/cio (channel I/O) subsystem in the Linux kernel contains a race condition in driver probing. When __driver_attach() calls the bus' match() callback, it intentionally does so without holding the device lock for performance reasons. However, concurrent access to the driver_override field during this window can result in use-after-free, as the field may be freed by one context while another is reading it. The vulnerability is classified as CWE-416 (Use After Free). The fix involves migrating to the kernel's generic driver_override infrastructure, which includes proper internal locking to prevent concurrent access regardless of whether the device lock is held during match().

Business impact

Successful exploitation enables local privilege escalation and denial of service on affected systems. An unprivileged user can trigger a UAF condition to corrupt kernel memory, potentially gaining root access or crashing the system. In containerized environments or multi-tenant systems, this significantly raises blast radius since any container or tenant with local access can compromise the host kernel. System availability and confidentiality are both at risk.

Affected systems

The vulnerability affects the Linux kernel, specifically systems using the s390 (IBM System z) architecture with the channel I/O (cio) subsystem. The vulnerability exists in the driver override matching logic, which impacts any s390 system where untrusted local users can trigger driver probing through udev rules, sysfs interactions, or direct kernel module operations. Systems not using s390 architecture are unaffected.

Exploitability

Exploitability is straightforward for local attackers. The vulnerability requires only local access (AV:L) and standard user privileges (PR:L), with no user interaction required (UI:N). The race condition can be triggered reliably by timing driver probe operations with concurrent modifications to driver_override. The attack surface is broad on systems permitting unprivileged user access to device binding mechanisms, though exploit complexity is low given the predictable nature of the race window.

Remediation

Affected systems must apply kernel patches that migrate the s390/cio driver override handling to use the kernel's generic driver_override infrastructure. This infrastructure encapsulates proper locking semantics, eliminating the race condition. Verify patch availability from your Linux distribution or verify against the upstream kernel stable branches (stable/linux-6.x.y or later depending on your baseline). As a temporary mitigation before patching, restrict unprivileged user access to driver binding mechanisms via AppArmor, SELinux, or by disabling dynamic driver binding where feasible.

Patch guidance

Patches are available through mainstream Linux kernel distributions. Verify your current kernel version against your distributor's advisory for s390/cio driver_override fixes. If using RHEL, Ubuntu, SUSE, or Debian on s390, consult the respective security advisories for CVE-2026-53117. For custom or enterprise kernels, pull the fix from upstream stable branches (verify commit hash in your vendor advisory). The fix is relatively small and low-risk, consisting of refactoring match() callback handling to use driver-core's locking rather than device-level locks.

Detection guidance

Monitor for: (1) UAF-related kernel panics with stack traces mentioning s390/cio or driver_override; (2) exploitation attempts via sysfs writes to /sys/bus/*/drivers/*/driver_override; (3) abnormal driver probe activity from unprivileged processes; (4) memory corruption errors in dmesg correlating with driver binding events. Use KASAN (Kernel Address Sanitizer) on test/canary systems to detect UAF in real time. Audit kernel logs for failed driver matches or probe errors that may indicate exploitation attempts.

Why prioritize this

This vulnerability merits high priority due to its combination of ease of exploitation and severity. Local privilege escalation is a primary attack vector in multi-tenant, containerized, and shared-access environments. The CVSS 7.8 (HIGH) score reflects the impact on confidentiality, integrity, and availability. Although KEV status is not yet set, the relatively straightforward nature of triggering the race condition and the broad applicability across s390 deployments justify rapid patching, particularly for internet-facing systems or those hosting untrusted workloads.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (AV:L)—requires local access; Attack Complexity Low (AC:L)—race condition is predictable; Privileges Required Low (PR:L)—standard user can trigger; User Interaction None (UI:N)—no social engineering needed; Scope Unchanged (S:U)—affects only the vulnerable system. The impact is High across Confidentiality, Integrity, and Availability due to potential kernel memory corruption enabling root access or DoS. This score appropriately captures the severity for local LPE scenarios.

Frequently asked questions