Linux kernel (drivers/bus/fsl-mc): The fsl-mc bus read its driver_override string without holding the device lock, so

Impact

The fsl-mc bus read its driver_override string without holding the device lock, so the string can be freed underneath a concurrent probe - a use-after-free in the exact mechanism used to force a device onto vfio-fsl-mc for passthrough. A corrupted override can also land a device on the wrong driver, meaning a device the operator intended to hand to a tenant instead binds to a host driver, or the reverse.

Who can reach it

Needs host root: writing /sys/bus/fsl-mc/devices/*/driver_override while a driver bind is in flight. This is the operator's own passthrough-provisioning path, not a tenant surface - the risk is an automation race in node preparation, plus anything that gets root on the host. Hardware-conditional: NXP DPAA2 / fsl-mc platforms only, not x86 or standard Arm server nodes.

What to do

Update to a stable kernel carrying commits 4911b836 / 8139ce66 on fsl-mc platforms. Interim: serialize driver_override writes against bind/unbind in your node-provisioning tooling. No action on x86 or Arm server fleets.

References