CVE-2026-63942 (GCVE-0-2026-63942)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-08-05 12:37
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: parport: Fix race between port and client registration The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to ports that are not completely initialised or even being torn down. When the port and client drivers are built as modules and loaded around the same time during boot, this occasionally results in a crash. I was able to make this happen reliably in a VM with a PC-style parallel port by patching parport_pc to fail probing: > --- a/drivers/parport/parport_pc.c > +++ b/drivers/parport/parport_pc.c > @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base, > if (!p) > goto out3; > > - base_res = request_region(base, 3, p->name); > + base_res = NULL; > if (!base_res) > goto out4; > and then running: while true; do modprobe lp & modprobe parport_pc wait rmmod lp parport_pc done for a few seconds. In the long term I think port registration should be changed to put the call to device_add() inside parport_announce_port(), but since the latter currently cannot fail this will require changing all port drivers. For now, add a flag to indicate whether a port has been "announced" and only try to attach client drivers to ports when the flag is set.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6fa45a22689722dac9f0e90c0931d4b34b334ede
Version: 6fa45a22689722dac9f0e90c0931d4b34b334ede
Version: 6fa45a22689722dac9f0e90c0931d4b34b334ede
Version: 6fa45a22689722dac9f0e90c0931d4b34b334ede
Version: 6fa45a22689722dac9f0e90c0931d4b34b334ede
Version: 6fa45a22689722dac9f0e90c0931d4b34b334ede
Version: 6fa45a22689722dac9f0e90c0931d4b34b334ede
Version: 6fa45a22689722dac9f0e90c0931d4b34b334ede
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/parport/share.c",
            "include/linux/parport.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3378b0d7bd4605de89b083b2900788157a181cc",
              "status": "affected",
              "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede",
              "versionType": "git"
            },
            {
              "lessThan": "290f515c5e3b3900bc2fe24f179999fd08d23bfa",
              "status": "affected",
              "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede",
              "versionType": "git"
            },
            {
              "lessThan": "d16548be2ea5058227d79799e81dab61c9bca8ec",
              "status": "affected",
              "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede",
              "versionType": "git"
            },
            {
              "lessThan": "15b1723c1472e802f9f7e69ae4e64f7dbf588848",
              "status": "affected",
              "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede",
              "versionType": "git"
            },
            {
              "lessThan": "51026cff1f4f3b762a0b5a07c727bd59cef45320",
              "status": "affected",
              "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede",
              "versionType": "git"
            },
            {
              "lessThan": "74d6aae1df45d3414178986be743f946988fddf6",
              "status": "affected",
              "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede",
              "versionType": "git"
            },
            {
              "lessThan": "a1e81b58da0179531bedf0b9f2811f5f992d5c4b",
              "status": "affected",
              "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede",
              "versionType": "git"
            },
            {
              "lessThan": "ef15ccbb3e8640a723c42ad90eaf81d66ae02017",
              "status": "affected",
              "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/parport/share.c",
            "include/linux/parport.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nparport: Fix race between port and client registration\n\nThe parport subsystem registers port devices before they are fully\ninitialised, resulting in a race condition where client drivers such\nas lp can attach to ports that are not completely initialised or even\nbeing torn down.\n\nWhen the port and client drivers are built as modules and loaded\naround the same time during boot, this occasionally results in a\ncrash.  I was able to make this happen reliably in a VM with a\nPC-style parallel port by patching parport_pc to fail probing:\n\n\u003e --- a/drivers/parport/parport_pc.c\n\u003e +++ b/drivers/parport/parport_pc.c\n\u003e @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base,\n\u003e  \tif (!p)\n\u003e  \t\tgoto out3;\n\u003e\n\u003e -\tbase_res = request_region(base, 3, p-\u003ename);\n\u003e +\tbase_res = NULL;\n\u003e  \tif (!base_res)\n\u003e  \t\tgoto out4;\n\u003e\n\nand then running:\n\n    while true; do\n        modprobe lp \u0026 modprobe parport_pc\n\twait\n\trmmod lp parport_pc\n    done\n\nfor a few seconds.\n\nIn the long term I think port registration should be changed to put\nthe call to device_add() inside parport_announce_port(), but since the\nlatter currently cannot fail this will require changing all port\ndrivers.\n\nFor now, add a flag to indicate whether a port has been \"announced\"\nand only try to attach client drivers to ports when the flag is set."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local kernel module registration paths (init_module/finit_module/modprobe or built-in initcalls during boot), not via network or physical port I/O. An attacker must locally orchestrate concurrent loading of parport client and port drivers.\nAC:L - The attacker controls both sides of the race by concurrently loading/unloading `lp` (or `ppdev`) and `parport_pc`; the fix author reproduced this reliably with a tight modprobe/rmmod loop. Success does not depend on uncontrollable timing or memory layout.\nPR:L - Triggering the race requires CAP_SYS_MODULE to load the relevant modules, which is obtainable by an unprivileged user in a user namespace on systems that permit it; it is not limited to irreducible init-namespace root.\nUI:N - Exploitation requires no victim interaction beyond the attacker\u0027s own module-load activity; boot-time crashes from parallel module loading also occur without user action.\nS:U - Impact is confined to kernel memory and availability within the same kernel security domain; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - Client drivers can attach while a port is partially initialized (e.g., NULL `port-\u003edev` causing `device_add` failure) or actively being torn down after probe failure, creating a use-after-free window on the `parport` structure that can expose kernel memory.\nI:H - The same race window permits client attachment to ports with uninitialized or freed `parport_operations`/private data, enabling calls through invalid function pointers and heap corruption primitives consistent with control-flow hijacking.\nA:H - Confirmed real-world kernel oops/panic during boot (Debian #1130365) with NULL instruction pointer, and the fix author demonstrated reliable crashes from the modprobe race loop."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:29.875Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3378b0d7bd4605de89b083b2900788157a181cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/290f515c5e3b3900bc2fe24f179999fd08d23bfa"
        },
        {
          "url": "https://git.kernel.org/stable/c/d16548be2ea5058227d79799e81dab61c9bca8ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/15b1723c1472e802f9f7e69ae4e64f7dbf588848"
        },
        {
          "url": "https://git.kernel.org/stable/c/51026cff1f4f3b762a0b5a07c727bd59cef45320"
        },
        {
          "url": "https://git.kernel.org/stable/c/74d6aae1df45d3414178986be743f946988fddf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1e81b58da0179531bedf0b9f2811f5f992d5c4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef15ccbb3e8640a723c42ad90eaf81d66ae02017"
        }
      ],
      "title": "parport: Fix race between port and client registration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63942",
    "datePublished": "2026-07-19T14:55:37.717Z",
    "dateReserved": "2026-07-19T07:54:57.022Z",
    "dateUpdated": "2026-08-05T12:37:29.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.