CVE-2026-80677 in Linux
要約
〜によって MITRE • 2026年08月28日
In the Linux kernel, the following vulnerability has been resolved:
driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
dev_has_sync_state() reads dev->driver twice without holding device_lock() -- once for the NULL check and once to dereference ->sync_state. Some callers only hold device_links_write_lock, which doesn't prevent a concurrent unbind from clearing dev->driver via device_unbind_cleanup().
Fix it by reading dev->driver exactly once with READ_ONCE(), pairing with the WRITE_ONCE() in device_set_driver().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.