Linux kernel vdpa: unlocked driver_override access can lead to use-after-free

Impact

The vdpa bus kept its own driver_override string and read it from the bus match() callback, which the driver core intentionally invokes without the device lock held. A concurrent write to the sysfs driver_override attribute while a vdpa device is being bound can free the string under the reader, giving a use-after-free in kernel context with the usual memory-corruption to local privilege escalation potential. This matters on hosts that use vDPA to hand accelerated virtio datapaths to guests or tenant VMs - the affected code is the device/driver binding path, not the datapath, so the exposure is on the management side of a node rather than on tenant traffic. Writing driver_override is a privileged sysfs operation, so this is not something an unprivileged tenant reaches.

Who can reach it

Local, and effectively root: the attacker needs write access to the vdpa device's sysfs driver_override attribute (plus a concurrent bind/probe) on the host. No tenant-facing or network path. Hosts without vDPA devices or the vdpa modules loaded are not affected.

What to do

Take the stable kernel that switches vdpa to the driver-core driver_override infrastructure (fix is backported across stable branches; see the linked commits for the exact release per branch). Requires installing a patched kernel and rebooting the node, which on a GPU host means draining workloads first. A livepatch is unlikely to cover this since the fix changes the data structure. Where a reboot cannot be scheduled, restricting write access to /sys/bus/vdpa/devices/*/driver_override removes the trigger.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-53143 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel list_lru: cgroup teardown race lets two CPUs unlink the same list item under different locksCVE-2026-53153 · Linux kernel mm/list_lru (memcg reparenting on cgroup teardown)High
• Linux mm: file-backed THP split reads folio state after dropping the last referenceCVE-2026-53189 · Linux kernel mm/huge_memory (__split_huge_pmd_locked RSS accounting)High
• Linux io_uring: bundle recv drops IORING_CQE_F_BUF_MORE, so userspace advances past a buffer the kernel still usesCVE-2026-53191 · Linux kernel io_uring/net (bundle recv, IORING_CQE_F_BUF_MORE inheritance)High
• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High
• Linux kernel IPv6: heap overwrite into skb_shared_info via UDPv6 MSG_MORE with MSG_SPLICE_PAGESCVE-2026-53362 · Linux kernel IPv6 (__ip6_append_data paged allocation path)High