High 7.8Published Jun 24, 2026

CVE-2026-53120PCI: use generic driver_override infrastructure

Updated under an hour ago (Oct 27, 2026, 7:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 782a985d7af26db39e86070d28f987cad21313c0 before fdfa287956d00b936e0ac409b21e4f90501ad109; from 782a985d7af26db39e86070d28f987cad21313c0 before dfe950d9464cad609f3b118c6203e2708055bc61; 782a985d7af26db39e86070d28f987cad21313c0 builds before 58a42be0d70307d765594fc581f5f5e5ef059712; from 782a985d7af26db39e86070d28f987cad21313c0 before c5b2c5755495507e14f310c2653c85de0a309b1f; 782a985d7af26db39e86070d28f987cad21313c0 builds before 10a4206a24013be4d558d476010cbf2eb4c9fa64	CNA record
linux linux_kernel linux:linux_kernel	from 3.16 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/fdfa287956d00b936e0ac409b21e4f90501ad109
https://git.kernel.org/stable/c/dfe950d9464cad609f3b118c6203e2708055bc61	patch
https://git.kernel.org/stable/c/58a42be0d70307d765594fc581f5f5e5ef059712	patch
https://git.kernel.org/stable/c/c5b2c5755495507e14f310c2653c85de0a309b1f	patch
https://git.kernel.org/stable/c/10a4206a24013be4d558d476010cbf2eb4c9fa64	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.