bus: fsl-mc: fix use-after-free in driver_override_show()
In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the device_lock around the read operation.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.15.201, 6.1.164, 6.12.74, 6.18.11, 6.19.1, 6.6.127
- CVEs
- CVE-2026-23221
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 03:43 UTC · Revision 1
Source evidence
bus: fsl-mc: fix use-after-free in driver_override_show()
core-osv · Original sourcePublished 18 Feb 2026, 14:53 UTC
In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the device_lock around the read operation.
osv:CVE-2026-23221
Kernel
Fixed versions: 5.15.201, 6.1.164, 6.6.127, 6.12.74, 6.18.11, 6.19.1
Complete source record
{
"id": "687bab1b81c55c21120e69f9d70395c91316ce50a0d79a24a992d8166e21694f",
"url": "https://osv.dev/vulnerability/CVE-2026-23221",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "bus: fsl-mc: fix use-after-free in driver_override_show()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the device_lock around the read operation.",
"evidence": "osv:CVE-2026-23221",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.15.201",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.164",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.127",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.74",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.11",
"evidence": "/affected/1/ranges"
},
{
"value": "6.19.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-23221",
"aliases": [
"CVE-2026-23221"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "1f86a00c1159fd77e66b1bd6ff1a183f4d46f34d"
},
{
"fixed": "c71dfb7833db7af652ee8f65011f14c97c47405d"
},
{
"fixed": "c424e72cfa67e7e1477035058a8a659f2c0ea637"
},
{
"fixed": "b1983840287303e0dfb401b1b6cecc5ea7471e90"
},
{
"fixed": "dd8ba8c0c3f3916d4ee1e3a09da9cd5caff5d227"
},
{
"fixed": "1d6bd6183e723a7b256ff34bbb5b498b5f4f2ec0"
},
{
"fixed": "a2ae33e1c6361e960a4d00f7cf75d880b54f9528"
},
{
"fixed": "148891e95014b5dc5878acefa57f1940c281c431"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23221.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.10.0"
},
{
"fixed": "5.15.201"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.164"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.127"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.74"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.11"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "6.19.1"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23221.json"
}
}
],
"modified": "2026-10-28T02:30:25.925320744Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/148891e95014b5dc5878acefa57f1940c281c431",
"https://git.kernel.org/stable/c/1d6bd6183e723a7b256ff34bbb5b498b5f4f2ec0",
"https://git.kernel.org/stable/c/a2ae33e1c6361e960a4d00f7cf75d880b54f9528",
"https://git.kernel.org/stable/c/b1983840287303e0dfb401b1b6cecc5ea7471e90",
"https://git.kernel.org/stable/c/c424e72cfa67e7e1477035058a8a659f2c0ea637",
"https://git.kernel.org/stable/c/c71dfb7833db7af652ee8f65011f14c97c47405d",
"https://git.kernel.org/stable/c/dd8ba8c0c3f3916d4ee1e3a09da9cd5caff5d227",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23221.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-23221",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23221.json"
}
},
"related_cves": [
{
"value": "CVE-2026-23221",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 492249,
"published_at": "2026-02-18T14:53:24.391+00:00"
}