CVE-2026-23221

A use-after-free flaw was found in the Linux kernel's Freescale Management Complex (fsl-mc) bus driver. The driver_override_show() sysfs function reads the driver_override string without acquiring the device_lock, while driver_override_store() modifies and frees the string while holding the lock. This race condition can result in a use-after-free if the string is freed by a concurrent store operation while being read by the show function.

This vulnerability affects systems with Freescale/NXP QorIQ DPAA2 hardware using the fsl-mc bus driver. Exploitation requires concurrent sysfs access to the driver_override attribute, typically requiring local access with appropriate permissions. The flaw is specific to embedded and data plane acceleration hardware platforms.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.