Linux kernel (drivers/pci): The PCI bus match callback read driver_override without the device lock, so the override

CVSS 6.6CVE-2026-53120Kernel, userspace & hypervisorcurated

Impact

The PCI bus match callback read driver_override without the device lock, so the override string can be freed while a probe is reading it - a use-after-free in the single mechanism a GPU cloud uses to force a card onto vfio-pci for passthrough. Beyond the memory-safety bug, a torn override read means a device can bind to the wrong driver: a card meant for a tenant lands on a host driver, or a host device lands on vfio-pci and becomes reachable from a container.

Who can reach it

Needs host root: writing /sys/bus/pci/devices/<bdf>/driver_override concurrently with a bind, which is exactly what node-provisioning automation does when it flips GPUs and NICs between host drivers and vfio-pci. Not tenant-reachable, but it sits on the provisioning path that decides who owns which device, and the xen-pciback stub is affected the same way.

What to do

Update to a stable kernel carrying commits dfe950d9 / 58a42be0. Interim: serialize driver_override writes against driver bind/unbind in your provisioning tooling - write the override, then bind, never concurrently - and verify the resulting driver binding before offering a device to a tenant.

References

https://git.kernel.org/stable/c/dfe950d9464cad609f3b118c6203e2708055bc61 https://git.kernel.org/stable/c/58a42be0d70307d765594fc581f5f5e5ef059712 https://nvd.nist.gov/vuln/detail/CVE-2026-53120

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.