CVE-2026-80677 (GCVE-0-2026-80677)
Vulnerability from cvelistv5
Published
2026-08-28 06:49
Modified
2026-08-29 06:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
dev_has_sync_state() reads dev->driver twice without holding
device_lock() -- once for the NULL check and once to dereference
->sync_state. Some callers only hold device_links_write_lock, which
doesn't prevent a concurrent unbind from clearing dev->driver via
device_unbind_cleanup().
Fix it by reading dev->driver exactly once with READ_ONCE(), pairing
with the WRITE_ONCE() in device_set_driver().
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ac338acf514e7b578fa9e3742ec2c292323b4c1a Version: ac338acf514e7b578fa9e3742ec2c292323b4c1a Version: ac338acf514e7b578fa9e3742ec2c292323b4c1a Version: ac338acf514e7b578fa9e3742ec2c292323b4c1a Version: ac338acf514e7b578fa9e3742ec2c292323b4c1a Version: ac338acf514e7b578fa9e3742ec2c292323b4c1a Version: ac338acf514e7b578fa9e3742ec2c292323b4c1a Version: ac338acf514e7b578fa9e3742ec2c292323b4c1a Version: 6d88283a49425eb469aa60ffebe76539e73c933e Version: 5.5.13 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/device.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89789e4c141904506163dcb91c7289a074573931",
"status": "affected",
"version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
"versionType": "git"
},
{
"lessThan": "51b3e1de53ee5b7775c7ff90e67fdb2665fce938",
"status": "affected",
"version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
"versionType": "git"
},
{
"lessThan": "358697929351f619143f59c6a8a15a4994748b79",
"status": "affected",
"version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
"versionType": "git"
},
{
"lessThan": "5e79e0180515b31b2e2244dc3d256fd8b5a07021",
"status": "affected",
"version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
"versionType": "git"
},
{
"lessThan": "860885fcd2611bca8c28dac8b2c1c7ff160f763e",
"status": "affected",
"version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
"versionType": "git"
},
{
"lessThan": "cc77f0d91e3214e4292208f02a1dc09a31f9aac7",
"status": "affected",
"version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
"versionType": "git"
},
{
"lessThan": "9b0f4082a09760939588135d60a8e9cc994bfa3e",
"status": "affected",
"version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
"versionType": "git"
},
{
"lessThan": "e9506871a8ea304cde48ff4a57226df2aadddae3",
"status": "affected",
"version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
"versionType": "git"
},
{
"status": "affected",
"version": "6d88283a49425eb469aa60ffebe76539e73c933e",
"versionType": "git"
},
{
"lessThan": "5.6",
"status": "affected",
"version": "5.5.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/device.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state()\n\ndev_has_sync_state() reads dev-\u003edriver twice without holding\ndevice_lock() -- once for the NULL check and once to dereference\n-\u003esync_state. Some callers only hold device_links_write_lock, which\ndoesn\u0027t prevent a concurrent unbind from clearing dev-\u003edriver via\ndevice_unbind_cleanup().\n\nFix it by reading dev-\u003edriver exactly once with READ_ONCE(), pairing\nwith the WRITE_ONCE() in device_set_driver()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in the driver-core device-link sync_state path, reached only via local device lifecycle operations (probe/bind, sysfs unbind, USBDEVFS disconnect/connect, module unload); there is no network, Bluetooth, or remote protocol entry point into dev_has_sync_state().\nAC:L - An attacker controls both race sides: one thread drives device_links_driver_bound() through USB connect/probe or bind while another hammers USBDEVFS_DISCONNECT or sysfs unbind on the same or linked supplier device, retriable at high frequency with no outcome depending on uncontrollable victim state.\nPR:L - USBDEVFS_DISCONNECT and USBDEVFS_CONNECT on /dev/bus/usb require no capability checks\u2014only rw access to the usbfs node that udev uaccess rules routinely grant seat users\u2014so unprivileged local users can drive the supplier unbind concurrent with automatic probe/link updates without init-namespace root.\nUI:N - The attacker initiates both the probe/device-link update and the concurrent unbind from their own processes; USB hotplug and automatic driver binding on shared workstations or kiosks also exercise this path without any deliberate action by another user.\nS:U - The TOCTOU and any resulting kernel memory fault or corruption stay within the host kernel driver-core security authority; exploitation does not cross VM, IOMMU, or sandbox boundaries.\nC:H - Between the two unsynchronized dev-\u003edriver loads, concurrent device_unbind_cleanup() can clear the pointer (NULL dereference of -\u003esync_state) or leave a stale device_driver pointer whose sync_state field is read from freed module memory\u2014a use-after-free read per kernel CNA UAF guidance.\nI:H - Use-after-free and torn pointer reads of dev-\u003edriver grant attacker-influenced heap reuse over the device_driver object; per CNA guidance UAF races enable corruption primitives and the freed sync_state function-pointer field can steer subsequent sync_state() dispatch on linked devices.\nA:H - Reloading dev-\u003edriver as NULL between the two reads makes dev-\u003edriver-\u003esync_state a NULL-page dereference, and the stale-pointer or post-rmmod variant faults on unmapped memory\u2014either way a repeatable kernel oops/panic in driver-core device-link processing."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:22:03.959Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89789e4c141904506163dcb91c7289a074573931"
},
{
"url": "https://git.kernel.org/stable/c/51b3e1de53ee5b7775c7ff90e67fdb2665fce938"
},
{
"url": "https://git.kernel.org/stable/c/358697929351f619143f59c6a8a15a4994748b79"
},
{
"url": "https://git.kernel.org/stable/c/5e79e0180515b31b2e2244dc3d256fd8b5a07021"
},
{
"url": "https://git.kernel.org/stable/c/860885fcd2611bca8c28dac8b2c1c7ff160f763e"
},
{
"url": "https://git.kernel.org/stable/c/cc77f0d91e3214e4292208f02a1dc09a31f9aac7"
},
{
"url": "https://git.kernel.org/stable/c/9b0f4082a09760939588135d60a8e9cc994bfa3e"
},
{
"url": "https://git.kernel.org/stable/c/e9506871a8ea304cde48ff4a57226df2aadddae3"
}
],
"title": "driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80677",
"datePublished": "2026-08-28T06:49:15.507Z",
"dateReserved": "2026-08-26T14:34:25.783Z",
"dateUpdated": "2026-08-29T06:22:03.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…