CVE-2026-63942: Linux Kernel Race Condition Vulnerability

CVE-2026-63942 Overview

CVE-2026-63942 is a race condition vulnerability in the Linux kernel parport subsystem. The subsystem registers port devices before they are fully initialized. Client drivers such as lp can attach to ports that are not completely initialized or are being torn down. When the port and client drivers are built as modules and loaded simultaneously during boot, the race can trigger a kernel crash. The issue affects local systems where an attacker with low privileges can influence module loading behavior to trigger memory corruption or denial of service.

Critical Impact
A local attacker with low privileges can trigger a race condition in the parport subsystem leading to kernel memory corruption, system crash, and potential local privilege escalation.

Affected Products

Linux kernel versions with the parport subsystem prior to the patched commits
Distributions shipping vulnerable kernels with parport_pc and lp modules
Systems where parport and client drivers such as lp are built as loadable kernel modules

Discovery Timeline

2026-07-19 - CVE-2026-63942 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63942

Vulnerability Analysis

The flaw resides in the Linux kernel parport subsystem, which manages parallel port devices. The subsystem calls device_add() to register a port before initialization completes. Client drivers such as lp monitor for new ports and attach as soon as registration is visible. Because the attachment can happen mid-initialization or during teardown, the client driver may operate on an inconsistent or partially freed port structure. This creates a Time-of-Check Time-of-Use (TOCTOU) window where kernel state is manipulated by concurrent module loading paths.

The patch introduces a flag indicating whether a port has been fully "announced" via parport_announce_port(). Client drivers only attempt attachment when the flag is set, closing the race window.

Root Cause

The root cause is a lifecycle ordering defect. Port devices become visible to client drivers before parport_announce_port() completes initialization. When probing of parport_pc fails or is torn down while lp is loading, the lp driver can bind to a port structure that is being freed. This results in use-after-free style corruption of kernel memory and a subsequent crash.

Attack Vector

The attack vector is local. An attacker capable of loading or triggering the loading of the parport_pc and lp kernel modules can race the two initialization paths. The reporter reproduced the crash reliably in a virtual machine by patching parport_pc to fail probing and repeatedly running modprobe lp & modprobe parport_pc in a loop followed by rmmod. On systems with automatic module loading via udev or hotplug, an unprivileged user connecting or emulating parallel port hardware may trigger the same race.

No verified exploit code is publicly available. The vulnerability is described in prose based on the upstream commit messages. See the Linux Kernel Commit 15b1723c for the authoritative technical description.

Detection Methods for CVE-2026-63942

Indicators of Compromise

Unexpected kernel panics or oops messages referencing parport, parport_pc, or lp in dmesg and /var/log/kern.log
Repeated modprobe invocations of parport_pc and lp in close succession from non-administrative contexts
Kernel stack traces containing parport_register_device, parport_announce_port, or lp_probe frames

Detection Strategies

Monitor kernel ring buffer for crash signatures involving the parport subsystem and correlate with module load events
Enable KASAN or KFENCE on test kernels to identify use-after-free conditions in the parport code paths
Audit auditdMODULE_LOAD events for concurrent loading of parport_pc and lp from unprivileged users

Monitoring Recommendations

Alert on kernel crashes on production Linux hosts and forward kdump output to a central log store for analysis
Track kernel version inventory across the fleet and flag hosts running unpatched parport code
Restrict which users can trigger automatic module loading by tightening modprobe and udev policy

How to Mitigate CVE-2026-63942

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor updates are available
Blacklist the parport, parport_pc, and lp modules on systems that do not require legacy parallel port support
Restrict module autoloading by setting kernel.modules_disabled=1 after boot on hardened systems

Patch Information

The fix adds a flag to indicate whether a port has been announced via parport_announce_port(), and client drivers only attach to announced ports. The patch is present in multiple stable kernel branches. Relevant upstream commits include Linux Kernel Commit 15b1723c, Linux Kernel Commit 290f515c, Linux Kernel Commit 51026cff, Linux Kernel Commit 74d6aae1, Linux Kernel Commit a1e81b58, Linux Kernel Commit d16548be, Linux Kernel Commit ef15ccbb, and Linux Kernel Commit f3378b0d. Consult your distribution's security advisories for backported package versions.

Workarounds

Blacklist the parport_pc and lp modules on systems that do not use parallel port hardware
Prevent concurrent loading by pre-loading parport_pc in initramfs before lp becomes eligible for automatic attachment
Restrict access to module loading utilities and remove CAP_SYS_MODULE from unprivileged workloads

bash

# Blacklist parport modules on systems that do not require parallel port support
cat <<EOF | sudo tee /etc/modprobe.d/blacklist-parport.conf
blacklist lp
blacklist parport_pc
blacklist parport
install lp /bin/true
install parport_pc /bin/true
install parport /bin/true
EOF

# Regenerate initramfs and reboot
sudo update-initramfs -u
sudo reboot