CVE-2026-53119: Linux Kernel WMI Driver Use-After-Free Privilege Escalation

Technical summary

The vulnerability is a use-after-free (UAF) condition in the platform/wmi subsystem. During driver probing via __driver_attach(), the bus match() callback is invoked without holding the device lock. This creates a race condition where the driver_override field can be accessed and modified concurrently, leading to UAF. The resolution involves migrating to the driver-core's generic driver_override infrastructure, which implements proper internal locking semantics to serialize access and prevent the race.

Business impact

Systems running vulnerable Linux kernel versions face elevated risk of local privilege escalation and denial of service. An unprivileged user could trigger kernel memory corruption, potentially leading to unauthorized data access or system unavailability. Organizations running WMI-dependent workloads—particularly virtualized or container environments—should prioritize assessment and patching.

Affected systems

The Linux kernel is affected. The vulnerability requires local access, so impact is primarily on multi-user systems, servers with local user accounts, or systems where container/VM escape is a concern. Kernels incorporating the vulnerable WMI platform driver code path are in scope.

Exploitability

Exploitability is moderate to high. The vulnerability requires local access (CWE-416 use-after-free) and standard user privileges. No special capabilities or complex setup is needed—a local attacker can trigger the race condition during normal driver probing. Active exploitation is feasible but requires timing or repeated attempts to hit the race window. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread public weaponization at the time of disclosure.

Remediation

Apply the kernel patch that refactors the WMI platform driver to use the generic driver_override infrastructure from driver-core. This centralizes locking logic and eliminates the unsynchronized access. Verify the patch version against your Linux distribution's advisory, as backport versions vary by vendor. Test in non-production environments before rollout to ensure stability.

Patch guidance

Consult your Linux distribution's security advisory for the specific patched kernel version. Patch vendors (Red Hat, Canonical, SUSE, etc.) will backport the fix to their supported kernel versions. Apply the patch through your standard kernel update process and reboot. Verify the fix is in place by checking kernel version and reviewing the changelog for mention of the WMI driver_override locking fix.

Detection guidance

Monitor system logs for UAF-related kernel warnings or crashes involving the WMI platform driver. Tools like systemtap or kernel Address Sanitizer (KASAN) can detect UAF conditions at runtime in test/lab environments. EDR solutions may flag unusual memory access patterns in kernel code. Kernel audit rules targeting driver probe operations can provide forensic evidence if exploitation is suspected.

Why prioritize this

A CVSS 7.8 HIGH severity local privilege escalation in the kernel warrants timely patching. The ease of triggering (no special privileges required) combined with the severity of impact (arbitrary kernel memory access) makes this a priority for systems with untrusted local users. Organizations should target patching within 2–4 weeks, depending on their risk tolerance and system criticality.

Risk score, explained

The score reflects a local-only vulnerability (AV:L) with low complexity (AC:L) and low privilege requirements (PR:L), but high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The CVSS 3.1 score of 7.8 is justified by the ease of exploitation and severity of potential impact—an unprivileged user can corrupt kernel memory or trigger denial of service without special tools or conditions.

Frequently asked questions