CVE-2026-80923

Description

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver() failure If tty_register_driver() fails, it drops the reference, but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when module exits. On module unload dbc_tty_exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver: module_init(xhci_hcd_init) xhci_hcd_init() xhci_dbc_init() [return value ignored] dbc_tty_init() tty_register_driver() fails tty_driver_kref_put() -> driver freed (dbc_tty_driver left dangling) ... module_exit(xhci_hcd_fini) xhci_hcd_fini() xhci_dbc_exit() dbc_tty_exit() if (dbc_tty_driver) -> true (dangling) tty_unregister_driver() -> use-after-free

Is your site exposed to CVE-2026-80923?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0017

Probability of exploitation

0.06%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/01b7bc0938061f2fd46e0094f6483d8c6c02f7d3 https://git.kernel.org/stable/c/0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922 https://git.kernel.org/stable/c/0e469b94fbba8eb03666da41dd1082b793c50c1a https://git.kernel.org/stable/c/33ed35ca629477f57e0dd1d77d6df96cf5a9eb55 https://git.kernel.org/stable/c/43635ff6401ca0e0ed21875379eeded921321525 https://git.kernel.org/stable/c/943f976c93e70563b132f5585ff68b08c89641a2 https://git.kernel.org/stable/c/a916fa66a43e10f63198b6ce978badffc678821a https://git.kernel.org/stable/c/eaca2814f32b9872a332326324b9e83e01f156d2

Frequently Asked Questions

What is CVE-2026-80923? +

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver() failure If tty_register_driver() fails, it drops the reference, but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when module exits. On module unload dbc_tty_exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver: module_init(xhci_hcd_init) xhci_hcd_init() xhci_dbc_init() [return value ignored] dbc_tty_init() tty_register_driver() fails tty_driver_kref_put() -> driver freed (dbc_tty_driver left dangling) ... module_exit(xhci_hcd_fini) xhci_hcd_fini() xhci_dbc_exit() dbc_tty_exit() if (dbc_tty_driver) -> true (dangling) tty_unregister_driver() -> use-after-free

How do I check if I'm vulnerable to CVE-2026-80923? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.