CVE-2026-80923

Received Received - Intake

Double Free in Linux Kernel XHCI Driver

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver() failure If tty_register_driver() fails, it drops the reference, but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when module exits. On module unload dbc_tty_exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver: module_init(xhci_hcd_init) xhci_hcd_init() xhci_dbc_init() [return value ignored] dbc_tty_init() tty_register_driver() fails tty_driver_kref_put() -> driver freed (dbc_tty_driver left dangling) ... module_exit(xhci_hcd_fini) xhci_hcd_fini() xhci_dbc_exit() dbc_tty_exit() if (dbc_tty_driver) -> true (dangling) tty_unregister_driver() -> use-after-free

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-10

AI Q&A

2026-09-10

EPSS Evaluated

N/A

NVD

CVE-2026-80923

EUVD

EUVD-2026-75100

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's xhci (USB 3.0 host controller) subsystem. When tty_register_driver() fails during driver initialization, the driver is freed but a global pointer (dbc_tty_driver) is not set to NULL. Later, during module unload, the cleanup function checks if this pointer is non-NULL and attempts to unregister the already-freed driver, causing a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's xhci dbgtty module and requires kernel-level inspection. Detection involves checking if the affected module is loaded and if the tty_register_driver() failure condition exists. Use commands like 'lsmod | grep xhci' to check module status and 'dmesg | grep tty_register_driver' to look for registration failures.

Impact Analysis

This vulnerability could lead to system crashes, kernel memory corruption, or privilege escalation if exploited. It affects systems using USB 3.0 host controllers with debug tty functionality enabled. Exploitation requires local access to trigger the failure condition during driver initialization.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel driver issue related to memory management during module unloading. Compliance impact would depend on system-specific configurations and usage.

Mitigation Strategies

Update your Linux kernel to the latest patched version where this issue is resolved. If immediate patching is not possible, consider unloading the xhci_hcd module if not in use. Monitor kernel logs for tty-related errors and disable the dbgtty feature via kernel parameters if available.

Hi! I’m here to help you understand CVE-2026-80923. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70