CVE-2026-80923: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver() failure If tty_register_driver() fails, it drops the reference, but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when module exits. On module unload dbc_tty_exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver: module_init(xhci_hcd_init) xhci_hcd_init() xhci_dbc_init() [return value ignored] dbc_tty_init() tty_register_driver() fails tty_driver_kref_put() -> driver freed (dbc_tty_driver left dangling) ... module_exit(xhci_hcd_fini) xhci_hcd_fini() xhci_dbc_exit() dbc_tty_exit() if (dbc_tty_driver) -> true (dangling) tty_unregister_driver() -> use-after-free

Affected products

• Linux Linux: from 5.9, before 5.15.220 (fixed in 5.15.220); from 5.16, before 6.1.187 (fixed in 6.1.187); from 6.2, before 6.6.156 (fixed in 6.6.156); from 6.7, before 6.12.108 (fixed in 6.12.108); from 6.13, before 6.18.49 (fixed in 6.18.49); from 6.19, before 7.1.13 (fixed in 7.1.13); …

Published 2026-09-09. Last modified 2026-09-09.