CVE-2026-80659
Received Received - Intake

USB Reset Deadlock in Linux Kernel vub300 Driver

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmd_mutex is unlocked vub300_cmndwork_thread() holds cmd_mutex while it sends a command and waits for the command response. If the response wait times out, __vub300_command_response() kills the command URBs and then synchronously resets the USB device through usb_reset_device(). That reset path re-enters the driver through vub300_pre_reset(), which also takes cmd_mutex. The worker therefore tries to acquire the same mutex recursively while it is still holding it from the command path. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the real worker and timeout/reset carrier: vub300_cmndwork_thread() __vub300_command_response() usb_lock_device_for_reset() usb_reset_device() vub300_pre_reset() Lockdep reported the same-task recursive acquisition on cmd_mutex: WARNING: possible recursive locking detected ... (&test_vub300.cmd_mutex) ... at: usb_reset_device... [vuln_msv] ... (&test_vub300.cmd_mutex) ... at: vub300_cmndwork_thread+0x12/0x20 [vuln_msv] Workqueue: vub300_cmd_wq vub300_cmndwork_thread [vuln_msv] *** DEADLOCK *** Return a flag from __vub300_command_response() when the timeout path needs a device reset, then perform the reset after vub300_cmndwork_thread() has cleared the in-flight command state and dropped cmd_mutex. The reset is still attempted before mmc_request_done(), preserving the existing request completion ordering while avoiding the recursive lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80659
EUVD
EUVD-2026-67535

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel mmc *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a deadlock issue in the Linux kernel's mmc vub300 driver. The vub300_cmndwork_thread function holds a mutex while sending commands and waiting for responses. If a timeout occurs, the driver attempts to reset the USB device, which re-enters the driver and tries to acquire the same mutex again. This causes a recursive lock, leading to a deadlock situation.

Detection Guidance

This vulnerability is specific to the Linux kernel's mmc subsystem and the vub300 driver. Detection requires checking for kernel logs indicating a recursive mutex lock in the vub300 driver or lockdep warnings about cmd_mutex. Use commands like 'dmesg | grep vub300' or 'journalctl -k | grep -i lock' to search for related errors.

Impact Analysis

This vulnerability can cause system hangs or crashes due to the deadlock. If the vub300 driver is used, the affected system may become unresponsive, leading to potential data loss or service disruption.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue involving a recursive mutex lock in the mmc vub300 module, which could lead to system instability or denial of service but does not involve data handling, privacy, or security controls relevant to these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If updating is not immediately possible, disable the vub300 driver module if not in use with 'modprobe -r vub300'. Monitor kernel logs for any signs of the deadlock occurring.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart