CVE-2026-53120: Linux Kernel PCI Driver Use-After-Free Local Privilege Escalation (CVSS 7.8)

Technical summary

CVE-2026-53120 is a use-after-free (UAF) vulnerability in the Linux kernel's PCI subsystem, specifically in the driver probe pathway. The issue occurs when __driver_attach() invokes the bus' match() callback without holding the device lock, creating an unsynchronized access window to the driver_override field. This allows concurrent modification or deallocation of the field while it is being read, violating memory safety. The fix involves migrating PCI's driver_override implementation to use the driver-core's generic driver_override infrastructure, which enforces proper locking semantics internally. The underlying design decision to call match() without the device lock is intentional per kernel architecture notes, necessitating synchronization at the field access level rather than the callback level.

Business impact

Successful exploitation enables local privilege escalation and potential kernel memory corruption. An unprivileged local user can trigger the race condition to achieve code execution at kernel level, compromising system integrity, confidentiality, and availability. For organizations running Linux-based infrastructure (servers, containers, embedded systems), this represents a significant risk to defense-in-depth posture, particularly in shared or multi-tenant environments. Patching is critical before exposing systems to untrusted local users.

Affected systems

The Linux kernel is affected. The vulnerability is present in kernel versions that have not yet integrated the driver-core generic driver_override infrastructure into the PCI subsystem. Check your kernel version and patch status against the vendor's official Linux kernel security advisories to determine precise affected releases and backport availability for your distribution (RHEL, Ubuntu, Debian, SUSE, etc.).

Exploitability

Exploitability is moderate to high. The vulnerability requires local access (CWE-416 use-after-free with AV:L) and is not gated behind special privileges—a standard user account suffices (PR:L). No user interaction or complex setup is required (AC:L, UI:N). The race condition window is narrow but feasible to trigger repeatedly. However, reliable exploitation may require kernel-specific knowledge and timing tuning. The CVSS 3.1 score of 7.8 (HIGH) reflects the severity of impact (C:H, I:H, A:H) balanced against the local-access prerequisite.

Remediation

Apply the Linux kernel patch that integrates PCI driver_override handling into the driver-core generic infrastructure. This is typically available as a stable kernel update or backport from the upstream fix. Verify the patch against your distribution's security advisory—many stable distributions (RHEL, Ubuntu LTS, Debian) will release kernel updates addressing this issue. If in-place patching is not immediately feasible, restrict local access to affected systems and disable PCI hotplug or driver override mechanisms if operationally safe.

Patch guidance

Consult your Linux distribution's official security advisory and kernel update channels. Major distributions will publish patched kernel versions; install via your package manager (apt, yum, dnf, zypper). Test patches in a staging environment first, as kernel updates require validation for your specific hardware and workload. Reboot is required to activate the patched kernel. Verify the running kernel version post-update using `uname -r`.

Detection guidance

Detection at the application level is difficult due to the in-kernel nature of the vulnerability. Monitor kernel logs for UAF-related warnings or panics, particularly around PCI driver binding events (dmesg, journalctl). Intrusion detection systems may flag anomalous local process behavior or privilege escalation attempts. The best detection strategy is proactive: maintain kernel patch currency and use security scanning tools (e.g., kernel Live Patch readiness checks) to identify unpatched systems in your inventory. Runtime behavioral analysis for unexpected kernel memory access patterns may also surface exploitation attempts in high-security environments.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS score (7.8), local privilege escalation capability, and straightforward exploit path. It affects a core kernel subsystem with broad exposure across Linux deployments. The lack of KEV (Known Exploited Vulnerability) status does not diminish risk; the vulnerability's technical simplicity and high impact make it an attractive target. Prioritize patching systems in order of: (1) multi-user or shared-access systems, (2) containers or cloud infrastructure, (3) critical servers, (4) single-user workstations.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (AV:L) – attacker must have local system access; Attack Complexity Low (AC:L) – exploit does not require special conditions; Privileges Required Low (PR:L) – standard user rights suffice; User Interaction None (UI:N) – automated exploitation is possible; Scope Unchanged (S:U) – impact is isolated to the affected system; and maximum impact on Confidentiality, Integrity, and Availability (C:H, I:H, A:H) – kernel-level compromise affects all three pillars. The score accurately captures a serious local privilege escalation that demands prompt remediation.

Frequently asked questions