CVE-2026-53120 describes a use-after-free vulnerability in the Linux kernel's PCI subsystem. When a driver is probed via __driver_attach(), the bus' match() callback is invoked without the device lock held, resulting in unsafe access to the driver_override field. This can cause a use-after-free condition (CWE-416). The vulnerability was addressed by switching to the generic driver_override infrastructure in the driver core, which manages locking correctly. The calling of match() without the device lock is intentional, but the fix ensures safe access internally.

The vulnerability allows local attackers with limited privileges to exploit a use-after-free condition, potentially leading to full system compromise affecting confidentiality, integrity, and availability. The CVSS 3.1 vector rates this as high severity with impact on all security properties (C:H/I:H/A:H). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates a fix has been implemented in the Linux kernel by adopting the generic driver_override infrastructure, which properly handles locking. Users should monitor official Linux kernel advisories and update to fixed kernel versions once available.