Vulnerability-Lookup

GHSA-JPRM-RCXH-4JGP

Vulnerability from github – Published: 2026-08-28 09:31 – Updated: 2026-08-29 09:30

Details

In the Linux kernel, the following vulnerability has been resolved:

driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

dev_has_sync_state() reads dev->driver twice without holding device_lock() -- once for the NULL check and once to dereference ->sync_state. Some callers only hold device_links_write_lock, which doesn't prevent a concurrent unbind from clearing dev->driver via device_unbind_cleanup().

Fix it by reading dev->driver exactly once with READ_ONCE(), pairing with the WRITE_ONCE() in device_set_driver().

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-80677"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-28T08:16:52Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state()\n\ndev_has_sync_state() reads dev-\u003edriver twice without holding\ndevice_lock() -- once for the NULL check and once to dereference\n-\u003esync_state. Some callers only hold device_links_write_lock, which\ndoesn\u0027t prevent a concurrent unbind from clearing dev-\u003edriver via\ndevice_unbind_cleanup().\n\nFix it by reading dev-\u003edriver exactly once with READ_ONCE(), pairing\nwith the WRITE_ONCE() in device_set_driver().",
  "id": "GHSA-jprm-rcxh-4jgp",
  "modified": "2026-08-29T09:30:28Z",
  "published": "2026-08-28T09:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80677"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/358697929351f619143f59c6a8a15a4994748b79"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/51b3e1de53ee5b7775c7ff90e67fdb2665fce938"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5e79e0180515b31b2e2244dc3d256fd8b5a07021"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/860885fcd2611bca8c28dac8b2c1c7ff160f763e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/89789e4c141904506163dcb91c7289a074573931"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9b0f4082a09760939588135d60a8e9cc994bfa3e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cc77f0d91e3214e4292208f02a1dc09a31f9aac7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e9506871a8ea304cde48ff4a57226df2aadddae3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-80677 (GCVE-0-2026-80677)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:49 – Updated: 2026-08-29 06:22

Title

driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

Summary

In the Linux kernel, the following vulnerability has been resolved: driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() dev_has_sync_state() reads dev->driver twice without holding device_lock() -- once for the NULL check and once to dereference ->sync_state. Some callers only hold device_links_write_lock, which doesn't prevent a concurrent unbind from clearing dev->driver via device_unbind_cleanup(). Fix it by reading dev->driver exactly once with READ_ONCE(), pairing with the WRITE_ONCE() in device_set_driver().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/89789e4c141904506…
https://git.kernel.org/stable/c/51b3e1de53ee5b777…
https://git.kernel.org/stable/c/358697929351f6191…
https://git.kernel.org/stable/c/5e79e0180515b31b2…
https://git.kernel.org/stable/c/860885fcd2611bca8…
https://git.kernel.org/stable/c/cc77f0d91e3214e42…
https://git.kernel.org/stable/c/9b0f4082a09760939…
https://git.kernel.org/stable/c/e9506871a8ea304cd…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ac338acf514e7b578fa9e3742ec2c292323b4c1a , < 89789e4c141904506163dcb91c7289a074573931 (git) Affected: ac338acf514e7b578fa9e3742ec2c292323b4c1a , < 51b3e1de53ee5b7775c7ff90e67fdb2665fce938 (git) Affected: ac338acf514e7b578fa9e3742ec2c292323b4c1a , < 358697929351f619143f59c6a8a15a4994748b79 (git) Affected: ac338acf514e7b578fa9e3742ec2c292323b4c1a , < 5e79e0180515b31b2e2244dc3d256fd8b5a07021 (git) Affected: ac338acf514e7b578fa9e3742ec2c292323b4c1a , < 860885fcd2611bca8c28dac8b2c1c7ff160f763e (git) Affected: ac338acf514e7b578fa9e3742ec2c292323b4c1a , < cc77f0d91e3214e4292208f02a1dc09a31f9aac7 (git) Affected: ac338acf514e7b578fa9e3742ec2c292323b4c1a , < 9b0f4082a09760939588135d60a8e9cc994bfa3e (git) Affected: ac338acf514e7b578fa9e3742ec2c292323b4c1a , < e9506871a8ea304cde48ff4a57226df2aadddae3 (git) Affected: 6d88283a49425eb469aa60ffebe76539e73c933e (git) Affected: 5.5.13 , < 5.6 (semver)
Linux	Linux	Affected: 5.6 Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/device.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "89789e4c141904506163dcb91c7289a074573931",
              "status": "affected",
              "version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
              "versionType": "git"
            },
            {
              "lessThan": "51b3e1de53ee5b7775c7ff90e67fdb2665fce938",
              "status": "affected",
              "version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
              "versionType": "git"
            },
            {
              "lessThan": "358697929351f619143f59c6a8a15a4994748b79",
              "status": "affected",
              "version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
              "versionType": "git"
            },
            {
              "lessThan": "5e79e0180515b31b2e2244dc3d256fd8b5a07021",
              "status": "affected",
              "version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
              "versionType": "git"
            },
            {
              "lessThan": "860885fcd2611bca8c28dac8b2c1c7ff160f763e",
              "status": "affected",
              "version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
              "versionType": "git"
            },
            {
              "lessThan": "cc77f0d91e3214e4292208f02a1dc09a31f9aac7",
              "status": "affected",
              "version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
              "versionType": "git"
            },
            {
              "lessThan": "9b0f4082a09760939588135d60a8e9cc994bfa3e",
              "status": "affected",
              "version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
              "versionType": "git"
            },
            {
              "lessThan": "e9506871a8ea304cde48ff4a57226df2aadddae3",
              "status": "affected",
              "version": "ac338acf514e7b578fa9e3742ec2c292323b4c1a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6d88283a49425eb469aa60ffebe76539e73c933e",
              "versionType": "git"
            },
            {
              "lessThan": "5.6",
              "status": "affected",
              "version": "5.5.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/device.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state()\n\ndev_has_sync_state() reads dev-\u003edriver twice without holding\ndevice_lock() -- once for the NULL check and once to dereference\n-\u003esync_state. Some callers only hold device_links_write_lock, which\ndoesn\u0027t prevent a concurrent unbind from clearing dev-\u003edriver via\ndevice_unbind_cleanup().\n\nFix it by reading dev-\u003edriver exactly once with READ_ONCE(), pairing\nwith the WRITE_ONCE() in device_set_driver()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the driver-core device-link sync_state path, reached only via local device lifecycle operations (probe/bind, sysfs unbind, USBDEVFS disconnect/connect, module unload); there is no network, Bluetooth, or remote protocol entry point into dev_has_sync_state().\nAC:L - An attacker controls both race sides: one thread drives device_links_driver_bound() through USB connect/probe or bind while another hammers USBDEVFS_DISCONNECT or sysfs unbind on the same or linked supplier device, retriable at high frequency with no outcome depending on uncontrollable victim state.\nPR:L - USBDEVFS_DISCONNECT and USBDEVFS_CONNECT on /dev/bus/usb require no capability checks\u2014only rw access to the usbfs node that udev uaccess rules routinely grant seat users\u2014so unprivileged local users can drive the supplier unbind concurrent with automatic probe/link updates without init-namespace root.\nUI:N - The attacker initiates both the probe/device-link update and the concurrent unbind from their own processes; USB hotplug and automatic driver binding on shared workstations or kiosks also exercise this path without any deliberate action by another user.\nS:U - The TOCTOU and any resulting kernel memory fault or corruption stay within the host kernel driver-core security authority; exploitation does not cross VM, IOMMU, or sandbox boundaries.\nC:H - Between the two unsynchronized dev-\u003edriver loads, concurrent device_unbind_cleanup() can clear the pointer (NULL dereference of -\u003esync_state) or leave a stale device_driver pointer whose sync_state field is read from freed module memory\u2014a use-after-free read per kernel CNA UAF guidance.\nI:H - Use-after-free and torn pointer reads of dev-\u003edriver grant attacker-influenced heap reuse over the device_driver object; per CNA guidance UAF races enable corruption primitives and the freed sync_state function-pointer field can steer subsequent sync_state() dispatch on linked devices.\nA:H - Reloading dev-\u003edriver as NULL between the two reads makes dev-\u003edriver-\u003esync_state a NULL-page dereference, and the stale-pointer or post-rmmod variant faults on unmapped memory\u2014either way a repeatable kernel oops/panic in driver-core device-link processing."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:03.959Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/89789e4c141904506163dcb91c7289a074573931"
        },
        {
          "url": "https://git.kernel.org/stable/c/51b3e1de53ee5b7775c7ff90e67fdb2665fce938"
        },
        {
          "url": "https://git.kernel.org/stable/c/358697929351f619143f59c6a8a15a4994748b79"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e79e0180515b31b2e2244dc3d256fd8b5a07021"
        },
        {
          "url": "https://git.kernel.org/stable/c/860885fcd2611bca8c28dac8b2c1c7ff160f763e"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc77f0d91e3214e4292208f02a1dc09a31f9aac7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b0f4082a09760939588135d60a8e9cc994bfa3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9506871a8ea304cde48ff4a57226df2aadddae3"
        }
      ],
      "title": "driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80677",
    "datePublished": "2026-08-28T06:49:15.507Z",
    "dateReserved": "2026-08-26T14:34:25.783Z",
    "dateUpdated": "2026-08-29T06:22:03.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.