CVE-2026-80732: ata: pata_sl82c105: fix bridge revision use-after-free
In the Linux kernel, the following vulnerability has been resolved:
ata: patasl82c105: fix bridge revision use-after-free
pcigetslot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pcidevice->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pcidevput(). The bridge may therefore be freed before its revision is read.
Read the revision before dropping the reference.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running a Linux kernel that includes the pata_sl82c105 driver and executes the affected bridge-revision path are exposed. The issue concerns a PCI bridge device reference obtained with pci_get_slot().
What condition is required to trigger the use-after-free?
The driver must obtain a referenced PCI device, release it with pci_dev_put(), and then access the device's cached revision field. The device may be freed between the reference release and that access.
How is the issue fixed?
The fix reads the PCI bridge revision before calling pci_dev_put(), so the revision is accessed while the PCI device reference is still held.