CVE-2026-53118

A flaw was found in the Linux kernel's vdpa driver. This vulnerability occurs because a specific field, driver_override, is accessed without proper locking during the driver's initialization process. An attacker could exploit this Use-After-Free (UAF) condition to potentially execute arbitrary code or cause a system crash (Denial of Service).

This vulnerability is rated Moderate because exploitation requires local authenticated access with specific privileges to interact with vDPA bus devices, restricting the attack surface and blast radius. In typical Red Hat Enterprise Linux deployments, vDPA hardware acceleration features are not active by default and are confined to specialized virtualization setups. While triggering the concurrency issue during device attachment can lead to a system crash, unauthenticated remote exploitation is not possible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.