Device Lock Enforcement in Linux Kernel Affects Driver Functionality

CVE-2026-31688

What is CVE-2026-31688?

A vulnerability in the Linux kernel involves improper enforcement of device locks within the driver core. The function driver_match_device() is invoked from various sites, leading to inconsistent lock handling. Specifically, while __device_attach_driver correctly holds the device lock, the other invocations do not, allowing bus match() callbacks to execute without the lock, creating a race condition. To resolve this, the new function driver_match_device_locked() ensures that device locks are consistently held, mitigating the risks of use-after-free conditions seen in the driver_override implementation. Stress testing confirmed the absence of race conditions or lock warnings following the implemented changes.

References