CVE-2026-80622

Received Received - Intake

Use-After-Free in Linux Kernel tlclk Driver

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup() This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the file_operations structure does not specify the .owner field, which could allow the module to be unloaded while user-space processes are still interacting with the device. Additionally, the tlclk_cleanup() function frees the alarm_events memory before ensuring that blocked processes in the waitqueue are fully awakened and that the switchover_timer has completed. To address these cases, this patch: - Sets '.owner = THIS_MODULE' in tlclk_fops to safely defer module unloading while the device is in use. - Updates tlclk_cleanup() to explicitly wake up all blocked readers (wake_up_all), properly release hardware I/O regions, and safely delete the timer (timer_delete_sync) prior to freeing memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80622

EUVD

EUVD-2026-67498

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the tlclk driver's cleanup process. The problem occurs because the module cleanup function frees memory before ensuring blocked processes are fully awakened and hardware resources are safely released. Additionally, the missing .owner field in the file_operations structure could allow the module to be unloaded while user-space processes are still using the device.

Detection Guidance

This vulnerability is specific to the Linux kernel's tlclk driver and does not have network-based detection methods. To detect it, check if your system is running a vulnerable kernel version and inspect the tlclk module for improper cleanup handling. Use commands like 'lsmod | grep tlclk' to check if the module is loaded and 'dmesg | grep tlclk' to look for related errors.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or privilege escalation if exploited. Attackers might trigger the use-after-free condition to execute arbitrary code or cause denial-of-service. Systems relying on the tlclk driver for timing or alarm functions could experience instability or unexpected behavior.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. The issue is a use-after-free and race condition in the Linux kernel's tlclk driver, which could lead to system instability or crashes but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Apply the kernel patch that sets .owner = THIS_MODULE in tlclk_fops and updates tlclk_cleanup() to properly handle cleanup. Update your Linux kernel to a version that includes this fix. If the module is not critical, consider unloading it with 'rmmod tlclk' until patched.

Hi! I’m here to help you understand CVE-2026-80622. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70