CVE-2026-80923: xhci: dbgtty: Fix unregister on tty_register_driver() failure
In the Linux kernel, the following vulnerability has been resolved:
xhci: dbgtty: Fix unregister on ttyregisterdriver() failure
If ttyregisterdriver() fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits.
On module unload dbcttyexit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver:
moduleinit(xhcihcdinit) xhcihcdinit() xhcidbcinit() [return value ignored] dbcttyinit() ttyregisterdriver() fails ttydriverkrefput() -> driver freed (dbcttydriver left dangling) ... moduleexit(xhcihcdfini) xhcihcdfini() xhcidbcexit() dbcttyexit() if (dbcttydriver) -> true (dangling) ttyunregisterdriver() -> use-after-free
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (xhci: dbgtty)to a version that resolves this vulnerability.Patch xhci: dbgtty: Fix unregister on tty_register_driver() failure
Event History
Frequently Asked Questions
Under what conditions can the use-after-free occur?
It requires tty_register_driver() to fail during xhci debug-tty initialization, followed later by module unload. The failed registration frees the driver while leaving dbc_tty_driver as a dangling non-NULL pointer, and exit cleanup then attempts to unregister it again.
What component lifecycle is involved in triggering the issue?
The sequence occurs during xhci_hcd_init() through xhci_dbc_init() and dbc_tty_init(), with the initialization return value ignored. The unsafe operation happens later during xhci_hcd_fini(), when xhci_dbc_exit() calls dbc_tty_exit() on module exit.
How can administrators determine whether the vulnerable failure path was reached?
The relevant condition is a failure from tty_register_driver() during xHCI debug-tty initialization followed by unloading the module. The provided information does not identify a specific log message or runtime indicator for confirming that condition.