CVE-2026-80732

HighCVSS 7.8/10Last modified Sep 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ata: pata_sl82c105: fix bridge revision use-after-free

pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore be freed before its revision is read.

Read the revision before dropping the reference.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 44c10138fd4bbc4b6d6bff0873c24902f2a9da65, < 1268ca9418e2217f2b60705cf4a280b689b26678; >= 44c10138fd4bbc4b6d6bff0873c24902f2a9da65, < a626dfca96041842053cf2d1efceb436c4cd8dcf; >= 44c10138fd4bbc4b6d6bff0873c24902f2a9da65, < 5ef87b1b4656d675440ceab32a56e69ad958d3a1; >= 44c10138fd4bbc4b6d6bff0873c24902f2a9da65, < fa0dca89b4fb0909ffda7b9ab6051af33270f95e; >= 44c10138fd4bbc4b6d6bff0873c24902f2a9da65, < dc711fb137b33c12e6ca22b6a9c9b9f21d49e4de; >= 44c10138fd4bbc4b6d6bff0873c24902f2a9da65, < a837deeaa37cc3f0e8c4e5c096787047f272c956; >= 44c10138fd4bbc4b6d6bff0873c24902f2a9da65, < 56fd78c8c820f527f8003e379ab71004b2e79a44; >= 44c10138fd4bbc4b6d6bff0873c24902f2a9da65, < 7700a31039cdc6715cb6cce7e7a664ee4e945f67
LinuxLinux2.6.23

References

Timeline

Published
Sep 3, 2026
Last modified
Sep 4, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-80733In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE() from sk_mc_loop() sk_mc_loop() can be calleCVE-2026-807348.8In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes [BUG] When runCVE-2026-807357.3In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some suCVE-2026-807367.8In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth CVE-2026-807377.8In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine_terminate_all()CVE-2026-807387.3In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bpf_tcp_CVE-2026-80739In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock In cCVE-2026-80743.8Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint,CVE-2026-80740In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scCVE-2026-807417.1In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kCVE-2026-80742In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't send zero-byte data in tpacket_snd(). syzbot reportedCVE-2026-80743In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers The irq
CVE-2026-80732: High severity, CVSS 7.8 | Vulnix