Use-after-free in Linux kernel - CVE-2026-80923
Published: September 9, 2026
Vulnerability identifier: #VU148815
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80923
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to trigger a use-after-free.
The vulnerability exists due to a dangling pointer in the xHCI debug tty driver when tty driver registration fails and the module is subsequently unloaded. A local privileged user can unload the module after a tty driver registration failure to trigger a use-after-free.
Affected software
Linux kernel
How to mitigate CVE-2026-80923
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/01b7bc0938061f2fd46e0094f6483d8c6c02f7d3
- https://git.kernel.org/stable/c/0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922
- https://git.kernel.org/stable/c/0e469b94fbba8eb03666da41dd1082b793c50c1a
- https://git.kernel.org/stable/c/33ed35ca629477f57e0dd1d77d6df96cf5a9eb55
- https://git.kernel.org/stable/c/43635ff6401ca0e0ed21875379eeded921321525
- https://git.kernel.org/stable/c/943f976c93e70563b132f5585ff68b08c89641a2
- https://git.kernel.org/stable/c/a916fa66a43e10f63198b6ce978badffc678821a
- https://git.kernel.org/stable/c/eaca2814f32b9872a332326324b9e83e01f156d2