CVE-2026-80732 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
ata: pata_sl82c105: fix bridge revision use-after-free
pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore be freed before its revision is read.
Read the revision before dropping the reference.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The Linux kernel vulnerability identified in the pata_sl82c105 driver involves a use-after-free error related to PCI device management and register access. This flaw stems from an incorrect sequence of operations when accessing hardware configuration data, specifically the bridge revision ID stored within the PCI configuration space. The root cause lies in the interaction between reference counting mechanisms for PCI devices and direct memory access patterns introduced by recent kernel refactoring efforts.
Historically, drivers accessed PCI device attributes through explicit function calls that handled reference management internally. However, a significant architectural change was implemented to optimize performance and simplify code paths across all PCI drivers. This change involved replacing runtime configuration-space reads with direct accesses to the cached revision field within the pci_dev structure. While this optimization improves efficiency by avoiding repeated I/O operations to the hardware bus, it places greater responsibility on driver authors to correctly manage device lifecycles. The specific commit responsible for introducing this vulnerability altered how the pata_sl82c105 driver retrieves bridge information but failed to update the corresponding reference counting logic appropriately.
The technical flaw occurs because pci_get_slot returns a pointer to a PCI device structure with an incremented reference count, indicating that the caller now holds responsibility for releasing that reference when it is no longer needed. The vulnerable code path proceeds to access the revision field directly from this structure but does so after calling pci_dev_put(), which decrements the reference count and potentially frees the underlying memory if the count reaches zero. Consequently, the driver attempts to read data from a memory location that may have already been deallocated by the kernel's device management subsystem. This constitutes a classic use-after-free condition where stale pointers are dereferenced after their associated resources have been reclaimed.
From a security perspective, this vulnerability is classified under CWE-416: Use After Free. The operational impact of such an error can vary significantly depending on memory allocation patterns and timing conditions within the kernel heap. In many cases, accessing freed memory may result in unpredictable behavior, including data corruption or system crashes leading to denial of service. More critically, if an attacker can influence the contents of the freed memory region through controlled allocations, they might achieve arbitrary code execution with kernel privileges. This would allow full compromise of the host system, bypassing user-space security boundaries and gaining complete control over hardware resources and sensitive data stored on connected storage devices managed by this ATA controller driver.
The vulnerability is further contextualized within the MITRE ATT&CK framework under techniques related to privilege escalation and defense evasion through memory corruption exploitation. Attackers targeting kernel vulnerabilities often look for use-after-free bugs because they provide a reliable mechanism to manipulate control flow or leak sensitive information from kernel space. The pata_sl82c105 driver handles Parallel ATA controllers, which are commonly found in legacy systems or specific embedded environments where such hardware interfaces remain relevant despite the prevalence of SATA and NVMe standards.
Mitigation for this issue requires correcting the order of operations within the affected code path. Developers must ensure that any access to fields within a PCI device structure occurs before releasing the reference count associated with that device. Specifically, the revision ID should be read while the pci_dev pointer is still valid and referenced. This simple reordering prevents the race condition between memory deallocation and data retrieval. For system administrators unable to immediately apply kernel patches, disabling or blacklisting the pata_sl82c105 module in environments where it is not strictly necessary can reduce the attack surface by preventing the vulnerable code from loading into kernel space during boot processes.
Long-term remediation involves rigorous review of all PCI driver modifications following architectural changes that shift access patterns from function calls to direct field accesses. Automated static analysis tools and dynamic memory checkers like KASAN should be employed in development pipelines to detect similar reference counting errors before they reach production kernels. Maintaining strict adherence to kernel API contracts regarding device lifecycle management is essential for preserving system stability and security integrity across all hardware abstraction layers within the Linux operating system ecosystem.