CVE-2026-53119: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53119 Overview

CVE-2026-53119 is a use-after-free (UAF) vulnerability in the Linux kernel's platform/wmi (Windows Management Instrumentation) subsystem. The flaw stems from unlocked access to the driver_override field during driver probing. When a driver is probed through __driver_attach(), the bus match() callback is invoked without holding the device lock. This permits concurrent access to driver_override without synchronization, leading to a use-after-free condition. The upstream fix migrates the WMI bus to the generic driver-core driver_override infrastructure, which handles locking internally.

Critical Impact
A race condition in the WMI bus match() callback allows unsynchronized access to driver_override, producing a use-after-free in kernel memory.

Affected Products

Linux kernel platform/wmi subsystem
Distributions shipping kernels prior to the fixing commits referenced in stable trees
Systems exposing WMI bus driver binding interfaces in sysfs

Discovery Timeline

2026-06-24 - CVE-2026-53119 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53119

Vulnerability Analysis

The Linux kernel driver-core framework supports a driver_override sysfs attribute that forces a device to bind to a specific driver. The WMI bus implemented its own driver_override handling rather than delegating to the generic driver-core infrastructure. The custom implementation did not coordinate locking with the driver-core probe path.

When __driver_attach() walks devices on a bus, it calls the bus match() callback without holding the device lock. This unlocked invocation is intentional in the kernel design. The WMI match() reads driver_override while a concurrent writer through sysfs can free and reassign the string. The result is a use-after-free on the freed driver_override buffer.

The vulnerability is classified as a kernel use-after-free affecting heap-allocated string memory. Exploitation requires local access to write to the driver_override sysfs attribute and timing to race against driver attachment. Successful exploitation could produce memory corruption with potential for privilege escalation or kernel information disclosure depending on object reuse.

Root Cause

The WMI subsystem maintained an independent driver_override implementation that did not serialize against the lockless match() invocation from __driver_attach(). Generic driver-core code already solves this by performing internal RCU or lock-protected reads of driver_override. The WMI custom path bypassed those guarantees.

Attack Vector

A local attacker with write access to /sys/bus/wmi/devices/<device>/driver_override can race a write against driver probing triggered through module loading or device hotplug. The race window is narrow but reachable on systems exposing WMI devices to userspace. No remote vector is documented, and no public exploit is available for this issue.

The vulnerability is described in prose only. See the upstream patches: Kernel Git Commit 13d201b, Kernel Git Commit 2c55070, Kernel Git Commit 4dc755d, and Kernel Git Commit 8a700b1.

Detection Methods for CVE-2026-53119

Indicators of Compromise

Kernel oops or KASAN use-after-free reports referencing driver_override or wmi_bus_match in stack traces
Unexpected writes to /sys/bus/wmi/devices/*/driver_override from non-administrative processes
Kernel panics correlated with WMI driver module load or unload events

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface UAF conditions during fuzzing of the WMI sysfs interface
Audit kernel ring buffer (dmesg) for slab-use-after-free signatures involving WMI components
Inventory running kernel versions against the fixing commits listed in the upstream stable trees

Monitoring Recommendations

Log auditd events for write operations against /sys/bus/wmi/**/driver_override
Forward kernel logs to a centralized SIEM and alert on UAF or KASAN string matches
Track local process activity that interacts with the WMI bus sysfs hierarchy on production hosts

How to Mitigate CVE-2026-53119

Immediate Actions Required

Update affected Linux kernels to a version containing the upstream patches referenced above
Restrict local user access on hosts exposing the WMI bus, since exploitation requires local sysfs write capability
Validate that distribution stable kernel updates incorporate the driver_override infrastructure migration for platform/wmi

Patch Information

The fix replaces the WMI bus custom driver_override handling with the generic driver-core infrastructure that performs proper internal locking. The patches are available in the upstream Linux stable tree at commits 13d201b, 2c55070, 4dc755d, and 8a700b1. Apply the kernel update provided by your distribution vendor that includes these commits.

Workarounds

Remove or restrict permissions on /sys/bus/wmi/devices/*/driver_override to limit write access to root only
Unload the wmi module on systems that do not require WMI functionality, removing the vulnerable code path
Apply mandatory access control policies (SELinux, AppArmor) to block unprivileged writes to WMI sysfs nodes

bash

# Configuration example: restrict access to WMI driver_override sysfs nodes
find /sys/bus/wmi/devices -name driver_override -exec chmod 600 {} \;

# Verify running kernel includes the fix
uname -r
dmesg | grep -i "wmi"