CVE-2026-53117: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53117 Overview

CVE-2026-53117 is a use-after-free (UAF) vulnerability in the Linux kernel's s390 Channel I/O (CIO) subsystem. The flaw resides in the handling of the driver_override field during driver probing on IBM System z (s390) architectures. When a driver is probed through __driver_attach(), the bus match() callback is invoked without holding the device lock. This allows concurrent access to the driver_override field without proper synchronization, leading to a use-after-free condition. The upstream fix migrates s390/cio to the generic driver-core driver_override infrastructure, which handles locking internally.

Critical Impact
A use-after-free in kernel-resident driver matching code on s390 architectures can corrupt kernel memory, leading to denial of service or potential local privilege escalation.

Affected Products

Linux kernel (s390 architecture) — Channel I/O (CIO) subsystem
Stable kernel branches referenced in the upstream commits (106d594, 2081957, ac4d8bb, b660ba0, c429548)
IBM System z and LinuxONE environments running affected kernel versions

Discovery Timeline

2026-06-24 - CVE-2026-53117 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53117

Vulnerability Analysis

The vulnerability affects the s390/cio driver subsystem, which manages Channel I/O devices on IBM mainframe Linux deployments. The driver_override mechanism allows administrators to force a specific driver to bind to a device. In the affected code path, s390/cio implemented its own driver_override handling rather than using the generic driver-core infrastructure.

When the kernel probes a device via __driver_attach(), it calls the bus match() callback intentionally without holding the device lock. The s390/cio match implementation reads the driver_override string field during this unlocked window. If a concurrent write to driver_override frees or reallocates the underlying string buffer, the match path dereferences freed memory, classifying the bug as a use-after-free [CWE-416].

Root Cause

The root cause is the absence of proper synchronization around accesses to driver_override in the s390/cio bus match callback. The custom implementation did not coordinate string lifetime with the unlocked match path. The driver-core's generic driver_override helpers (driver_set_override() and the matching read accessors) internally use the appropriate locking and reference handling to prevent this race. Replacing the custom code with the generic infrastructure eliminates the race window.

Attack Vector

Triggering the UAF requires local interaction with sysfs to write driver_override for an s390/cio device concurrently with driver probing activity. An attacker with privileges to modify device driver_override sysfs entries could attempt to race a write against __driver_attach()-driven matching. Successful exploitation could free or reuse the string buffer while the match callback is reading it, producing kernel memory corruption. The vulnerability is constrained to s390 systems and requires sufficient privileges to write the relevant sysfs attributes.

No public proof-of-concept exploit code is available for this issue. See the upstream commits referenced below for the precise code paths involved.

Detection Methods for CVE-2026-53117

Indicators of Compromise

Unexpected kernel oops or panic messages referencing cio, ccw_bus_match, or driver_override in dmesg or /var/log/messages
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in s390 CIO match paths on instrumented kernels
Unexplained driver rebinding events on Channel I/O devices preceding kernel instability

Detection Strategies

Inventory s390/LinuxONE hosts and compare running kernel versions against the patched stable releases referenced in the upstream commits
Audit sysfs write activity to driver_override attributes under /sys/bus/ccw/devices/ for unexpected writers
Enable kernel crash collection (kdump) to capture stack traces from any CIO-related faults for post-incident analysis

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on kernel oops, BUG, or KASAN messages mentioning cio or driver_override
Monitor for unauthorized local accounts gaining write access to device sysfs attributes
Track patch deployment state across s390 fleets to verify the fix is applied uniformly

How to Mitigate CVE-2026-53117

Immediate Actions Required

Apply the upstream Linux kernel patches that migrate s390/cio to the generic driver_override infrastructure, available in the referenced stable commits
Restrict write access to driver_override sysfs attributes to trusted administrators only
Reboot affected s390 systems after kernel updates to ensure the patched code is active

Patch Information

The fix is distributed across multiple stable kernel branches. Reference commits include Kernel Git Commit 106d59, Kernel Git Commit 208195, Kernel Git Commit ac4d8b, Kernel Git Commit b660ba, and Kernel Git Commit c42954. Consult your Linux distribution's security tracker for vendor-specific kernel package versions that include these commits.

Workarounds

Limit local user access on s390/LinuxONE systems to reduce the population of accounts able to write device sysfs attributes
Avoid scripted or automated writes to driver_override until the patched kernel is deployed
Where feasible, disable or unbind unused Channel I/O devices to reduce the attack surface for the match race

bash

# Verify kernel version on s390 hosts and check patch state
uname -r
# Confirm restricted permissions on driver_override sysfs attributes
find /sys/bus/ccw/devices -name driver_override -exec ls -l {} \;