CVE-2026-80677

HighCVSS 7.8/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

dev_has_sync_state() reads dev->driver twice without holding device_lock() -- once for the NULL check and once to dereference ->sync_state. Some callers only hold device_links_write_lock, which doesn't prevent a concurrent unbind from clearing dev->driver via device_unbind_cleanup().

Fix it by reading dev->driver exactly once with READ_ONCE(), pairing with the WRITE_ONCE() in device_set_driver().

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ac338acf514e7b578fa9e3742ec2c292323b4c1a, < 89789e4c141904506163dcb91c7289a074573931; >= ac338acf514e7b578fa9e3742ec2c292323b4c1a, < 51b3e1de53ee5b7775c7ff90e67fdb2665fce938; >= ac338acf514e7b578fa9e3742ec2c292323b4c1a, < 358697929351f619143f59c6a8a15a4994748b79; >= ac338acf514e7b578fa9e3742ec2c292323b4c1a, < 5e79e0180515b31b2e2244dc3d256fd8b5a07021; >= ac338acf514e7b578fa9e3742ec2c292323b4c1a, < 860885fcd2611bca8c28dac8b2c1c7ff160f763e; >= ac338acf514e7b578fa9e3742ec2c292323b4c1a, < cc77f0d91e3214e4292208f02a1dc09a31f9aac7; >= ac338acf514e7b578fa9e3742ec2c292323b4c1a, < 9b0f4082a09760939588135d60a8e9cc994bfa3e; >= ac338acf514e7b578fa9e3742ec2c292323b4c1a, < e9506871a8ea304cde48ff4a57226df2aadddae3; 6d88283a49425eb469aa60ffebe76539e73c933e; >= 5.5.13, < 5.6
LinuxLinux5.6

References

Timeline

Published
Aug 28, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-806788.4In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reCVE-2026-80679In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasd_release_space()CVE-2026-806807.8In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_regisCVE-2026-806819.8In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shoCVE-2026-806827.8In the Linux kernel, the following vulnerability has been resolved: riscv/mm: use physical alignment for vmemmap_start_pfn RISC-V computesCVE-2026-806838.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own sco_conn reference sco_conn_deCVE-2026-806849.3In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The aiCVE-2026-806857.1In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snaCVE-2026-80686In the Linux kernel, the following vulnerability has been resolved: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE ptCVE-2026-80687In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevice_size error path CVE-2026-80688In the Linux kernel, the following vulnerability has been resolved: riscv: drop __init from vec_check_unaligned_access_speed_all_cpus ThisCVE-2026-80689In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmio_trace_array in logging funct
CVE-2026-80677: High severity, CVSS 7.8 | Vulnix