CVE-2026-80923xhci: dbgtty: Fix unregister on tty_register_driver() failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver() failure If tty_register_driver() fails, it drops the reference, but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when module exits. On module unload dbc_tty_exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver: module_init(xhci_hcd_init) xhci_hcd_init() xhci_dbc_init() [return value ignored] dbc_tty_init() tty_register_driver() fails tty_driver_kref_put() -> driver freed (dbc_tty_driver left dangling) ... module_exit(xhci_hcd_fini) xhci_hcd_fini() xhci_dbc_exit() dbc_tty_exit() if (dbc_tty_driver) -> true (dangling) tty_unregister_driver() -> use-after-free
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 4521f16139409cdf9462c7325d43454462cff6c3 builds before 01b7bc0938061f2fd46e0094f6483d8c6c02f7d3; from 4521f16139409cdf9462c7325d43454462cff6c3 before 43635ff6401ca0e0ed21875379eeded921321525; from 4521f16139409cdf9462c7325d43454462cff6c3 before eaca2814f32b9872a332326324b9e83e01f156d2; 4521f16139409cdf9462c7325d43454462cff6c3 builds before 943f976c93e70563b132f5585ff68b08c89641a2; 4521f16139409cdf9462c7325d43454462cff6c3 builds before 0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922; 4521f16139409cdf9462c7325d43454462cff6c3 builds before 33ed35ca629477f57e0dd1d77d6df96cf5a9eb55; 4521f16139409cdf9462c7325d43454462cff6c3 builds before 0e469b94fbba8eb03666da41dd1082b793c50c1a; from 4521f16139409cdf9462c7325d43454462cff6c3 before a916fa66a43e10f63198b6ce978badffc678821a | CNA record |
References
- https://git.kernel.org/stable/c/01b7bc0938061f2fd46e0094f6483d8c6c02f7d3
- https://git.kernel.org/stable/c/43635ff6401ca0e0ed21875379eeded921321525
- https://git.kernel.org/stable/c/eaca2814f32b9872a332326324b9e83e01f156d2
- https://git.kernel.org/stable/c/943f976c93e70563b132f5585ff68b08c89641a2
- https://git.kernel.org/stable/c/0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922
- https://git.kernel.org/stable/c/33ed35ca629477f57e0dd1d77d6df96cf5a9eb55
- https://git.kernel.org/stable/c/0e469b94fbba8eb03666da41dd1082b793c50c1a
- https://git.kernel.org/stable/c/a916fa66a43e10f63198b6ce978badffc678821a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.