CVE-2026-53115: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53115 Overview

CVE-2026-53115 is a use-after-free (UAF) vulnerability in the Linux kernel's Freescale Management Complex (fsl-mc) bus driver. The flaw resides in the bus match() callback, which accesses the driver_override field without holding the device lock. When __driver_attach() probes a driver, it intentionally invokes match() without the device lock held, exposing the unsynchronized driver_override access to concurrent modification.

The fix replaces the local driver_override handling with the driver-core's generic driver_override infrastructure, which manages locking internally and prevents the race condition.

Critical Impact
A local attacker with the ability to trigger driver binding and modify driver_override sysfs attributes concurrently can cause memory corruption in the kernel, leading to denial of service or potential privilege escalation.

Affected Products

Linux kernel versions containing the fsl-mc bus driver prior to the patched commits
Systems using NXP/Freescale DPAA2 Management Complex hardware
Distributions shipping affected stable kernel branches

Discovery Timeline

2026-06-24 - CVE-2026-53115 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53115

Vulnerability Analysis

The vulnerability stems from improper synchronization in the fsl-mc bus driver's match() callback. The Linux driver core invokes match() from __driver_attach() without acquiring the device lock. This is intentional behavior in the driver core. However, the fsl-mc bus implementation reads the driver_override field directly during this unlocked invocation.

The driver_override field is a heap-allocated string that userspace can modify through the corresponding sysfs attribute. Userspace can write to this attribute concurrently with driver matching, freeing and reallocating the underlying memory. The unlocked read in match() can then dereference a freed pointer or observe a torn write, classifying the issue as a use-after-free [CWE-416].

Root Cause

The root cause is the fsl-mc bus driver implementing its own driver_override handling without proper locking semantics. The local implementation does not coordinate with the lockless match() invocation path. The driver-core provides a generic driver_override infrastructure that handles all locking internally, but the fsl-mc bus did not adopt it.

Attack Vector

Exploitation requires local access with permissions to write the fsl-mc device driver_override sysfs attribute. An attacker writes new values to /sys/bus/fsl-mc/devices/<device>/driver_override while concurrently triggering driver attach operations. The race window between freeing the old override string and the unlocked read in match() enables the UAF condition.

The vulnerability is described in the upstream commits referenced in the kernel changelog. See Kernel Change Log Entry for the patch details.

Detection Methods for CVE-2026-53115

Indicators of Compromise

Kernel panics, oops messages, or KASAN reports referencing the fsl-mc bus match() function or driver_override field
Unexpected driver binding behavior on fsl-mc devices following sysfs writes
Repeated writes to /sys/bus/fsl-mc/devices/*/driver_override from non-administrative processes

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test systems to surface use-after-free conditions in the fsl-mc bus code paths
Audit kernel version banners across the fleet to identify hosts running pre-patch kernels with fsl-mc support compiled in
Correlate userspace writes to driver_override sysfs nodes with subsequent kernel error logs

Monitoring Recommendations

Forward kernel logs (dmesg, /var/log/kern.log) to a centralized logging platform and alert on oops, BUG, or KASAN signatures
Monitor file integrity and access patterns on /sys/bus/fsl-mc/ to detect unauthorized override manipulation
Track kernel package versions through configuration management tooling and flag systems missing the relevant stable backport

How to Mitigate CVE-2026-53115

Immediate Actions Required

Apply the patched stable kernel build that includes the fsl-mc bus migration to the generic driver_override infrastructure
Restrict write access to /sys/bus/fsl-mc/devices/*/driver_override to privileged accounts only
Inventory systems using NXP DPAA2 hardware and prioritize them for patching

Patch Information

The vulnerability is resolved by switching the fsl-mc bus to the driver-core's generic driver_override infrastructure, which handles locking internally. Patched commits are available in the upstream stable trees:

Workarounds

Unload or blacklist the fsl_mc_bus kernel module on systems that do not require DPAA2 functionality
Tighten sysfs permissions via udev rules to prevent non-root users from writing driver_override attributes
Apply mandatory access control policies (SELinux, AppArmor) restricting write access to fsl-mc sysfs nodes

bash

# Restrict driver_override write access via udev rule
# /etc/udev/rules.d/99-fsl-mc-override.rules
SUBSYSTEM=="fsl-mc", ACTION=="add", \
  RUN+="/bin/chmod 0600 /sys/bus/fsl-mc/devices/%k/driver_override"

# Verify kernel version after patching
uname -r

# Optionally blacklist the module if unused
echo "blacklist fsl_mc_bus" | sudo tee /etc/modprobe.d/blacklist-fsl-mc.conf
sudo update-initramfs -u