CVE-2026-80676: Drivers: hv: vmbus: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: vmbus: use generic driveroverride infrastructure
When a driver is probed through driverattach(), the bus' match() callback is called without the device lock held, thus accessing the driveroverride field without a lock, which can cause a UAF.
Fix this by using the driver-core driveroverride infrastructure taking care of proper locking internally.
Note that calling match() from driverattach() without the device lock held is intentional. [1]
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the Hyper-V VMBus driver path are relevant. The issue occurs when the VMBus bus match callback accesses driver_override during driver probing through __driver_attach().
What condition is required to trigger the use-after-free?
The vulnerable path requires driver probing through __driver_attach() while the VMBus match callback accesses the driver_override field without the device lock held. The provided information does not identify a remote trigger or a specific attacker capability.
How is the issue addressed?
The fix changes VMBus to use the generic driver-core driver_override infrastructure, which handles the necessary locking internally. The referenced stable-kernel commits contain the remediation.