CVE-2026-80660 (GCVE-0-2026-80660)
Vulnerability from cvelistv5
Published
2026-08-28 06:49
Modified
2026-08-28 06:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (occ) unregister sysfs devices outside occ lock
occ_active(false) and occ_shutdown() unregister sysfs-backed devices while
occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can
wait for active sysfs callbacks to drain, and those callbacks can enter the
OCC update path and try to take occ->lock again. That gives the unregister
paths the lock ordering occ->lock -> sysfs callback drain, while a callback
has the opposite edge sysfs callback -> occ->lock.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the real unregister and callback carrier:
occ_shutdown()
hwmon_device_unregister()
occ_show_temp_1()
occ_update_response()
Lockdep reported the circular dependency with occ_shutdown() already
holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs
side:
WARNING: possible circular locking dependency detected
... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]
... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]
occ_update_response.isra.0+0xb/0x20 [vuln_msv]
occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]
*** DEADLOCK ***
Serialize hwmon registration and removal with a separate hwmon_lock.
Under that lock, detach occ->hwmon and update occ->active while occ->lock
is held so concurrent OCC state changes still see a stable state, then
drop occ->lock before calling hwmon_device_unregister(). Remove the
driver sysfs group before taking occ->lock in occ_shutdown(), so draining
the driver attributes cannot wait while the OCC mutex is held. Also make
OCC update callbacks return -ENODEV after deactivation, so callbacks that
already passed sysfs active protection do not poll the hardware after
teardown has detached the hwmon device.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 849b0156d9960da628a06756bb920d9571c15e66 Version: 849b0156d9960da628a06756bb920d9571c15e66 Version: 849b0156d9960da628a06756bb920d9571c15e66 Version: 849b0156d9960da628a06756bb920d9571c15e66 Version: 849b0156d9960da628a06756bb920d9571c15e66 Version: 849b0156d9960da628a06756bb920d9571c15e66 Version: bc8a32726774286325b0cb0daab55b682cafc1ef Version: 5.15.216 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/occ/common.c",
"drivers/hwmon/occ/common.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2a4c80ff3571498ec6a916273304b6650026b1b0",
"status": "affected",
"version": "849b0156d9960da628a06756bb920d9571c15e66",
"versionType": "git"
},
{
"lessThan": "e7fd81e9fb1fe476d2131fec66c1138457810ed4",
"status": "affected",
"version": "849b0156d9960da628a06756bb920d9571c15e66",
"versionType": "git"
},
{
"lessThan": "2092952f22a7da98e76e84139ae202b1fc7ba899",
"status": "affected",
"version": "849b0156d9960da628a06756bb920d9571c15e66",
"versionType": "git"
},
{
"lessThan": "f0aad157576da199c146c1bb266442befa7912ca",
"status": "affected",
"version": "849b0156d9960da628a06756bb920d9571c15e66",
"versionType": "git"
},
{
"lessThan": "7ee43ec8e6774774abbe9dc3027225e01bc964a5",
"status": "affected",
"version": "849b0156d9960da628a06756bb920d9571c15e66",
"versionType": "git"
},
{
"lessThan": "e31408734332b8cc611342cdaaab6ba492180156",
"status": "affected",
"version": "849b0156d9960da628a06756bb920d9571c15e66",
"versionType": "git"
},
{
"status": "affected",
"version": "bc8a32726774286325b0cb0daab55b682cafc1ef",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.216",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/occ/common.c",
"drivers/hwmon/occ/common.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.216",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (occ) unregister sysfs devices outside occ lock\n\nocc_active(false) and occ_shutdown() unregister sysfs-backed devices while\nocc-\u003elock is held. hwmon_device_unregister() and sysfs_remove_group() can\nwait for active sysfs callbacks to drain, and those callbacks can enter the\nOCC update path and try to take occ-\u003elock again. That gives the unregister\npaths the lock ordering occ-\u003elock -\u003e sysfs callback drain, while a callback\nhas the opposite edge sysfs callback -\u003e occ-\u003elock.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the real unregister and callback carrier:\n\n occ_shutdown()\n hwmon_device_unregister()\n occ_show_temp_1()\n occ_update_response()\n\nLockdep reported the circular dependency with occ_shutdown() already\nholding the OCC mutex and hwmon_device_unregister() waiting on the sysfs\nside:\n\n WARNING: possible circular locking dependency detected\n ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]\n ... (\u0026test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]\n occ_update_response.isra.0+0xb/0x20 [vuln_msv]\n occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]\n *** DEADLOCK ***\n\nSerialize hwmon registration and removal with a separate hwmon_lock.\nUnder that lock, detach occ-\u003ehwmon and update occ-\u003eactive while occ-\u003elock\nis held so concurrent OCC state changes still see a stable state, then\ndrop occ-\u003elock before calling hwmon_device_unregister(). Remove the\ndriver sysfs group before taking occ-\u003elock in occ_shutdown(), so draining\nthe driver attributes cannot wait while the OCC mutex is held. Also make\nOCC update callbacks return -ENODEV after deactivation, so callbacks that\nalready passed sysfs active protection do not poll the hardware after\nteardown has detached the hwmon device."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:49:04.992Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2a4c80ff3571498ec6a916273304b6650026b1b0"
},
{
"url": "https://git.kernel.org/stable/c/e7fd81e9fb1fe476d2131fec66c1138457810ed4"
},
{
"url": "https://git.kernel.org/stable/c/2092952f22a7da98e76e84139ae202b1fc7ba899"
},
{
"url": "https://git.kernel.org/stable/c/f0aad157576da199c146c1bb266442befa7912ca"
},
{
"url": "https://git.kernel.org/stable/c/7ee43ec8e6774774abbe9dc3027225e01bc964a5"
},
{
"url": "https://git.kernel.org/stable/c/e31408734332b8cc611342cdaaab6ba492180156"
}
],
"title": "hwmon: (occ) unregister sysfs devices outside occ lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80660",
"datePublished": "2026-08-28T06:49:04.992Z",
"dateReserved": "2026-08-26T14:34:25.780Z",
"dateUpdated": "2026-08-28T06:49:04.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…