CVE-2026-80830
Received Received - Intake

USB Race Condition in Linux Kernel USB Core

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: core: Add lock to usb_wakeup_notification() Add a spin lock to usb_wakeup notification to prevent a race condition with dereferencing freed memory. This could be hit by the xHCI driver as it calls this function from an IRQ and could race with the hub_disconnect() function, which properly grabs this lock to protect the state of the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80830
EUVD
EUVD-2026-71280

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in the Linux kernel's USB core subsystem. A spin lock was added to the usb_wakeup_notification() function to prevent a race condition where the xHCI driver could dereference freed memory while handling USB wakeup notifications from an IRQ context. The race occurs when hub_disconnect() tries to access the same memory without proper synchronization.

Detection Guidance

This vulnerability involves a race condition in the Linux kernel's USB core, specifically in the usb_wakeup_notification() function. Detection requires checking for kernel logs or crashes related to USB device handling or xHCI driver issues. Monitor system logs for USB-related errors or kernel panics.

Impact Analysis

This vulnerability could lead to system crashes or instability if exploited. It may cause kernel panics or unexpected behavior when USB devices are disconnected while wakeup notifications are processed. Users might experience sudden system freezes or reboot loops under specific USB device scenarios.

Mitigation Strategies

Apply the latest Linux kernel updates to patch this vulnerability. If immediate patching is not possible, consider disabling USB wakeup notifications or restricting USB device connections until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart