Answer in brief
CVE-2026-80677 records a Unknown severity vulnerability in driver core: use READ_ONCE() for dev->driver in dev_has_sync_state(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ac338acf514e7b578fa9e3742ec2c292323b4c1a <89789e4c141904506163dcb91c7289a074573931 || >=ac338acf514e7b578fa9e3742ec2c292323b4c1a <51b3e1de53ee5b7775c7ff90e67fdb2665fce938 || >=ac338acf514e7b578fa9e3742ec2c292323b4c1a <358697929351f619143f59c6a8a15a4994748b79 || >=ac338acf514e7b578fa9e3742ec2c292323b4c1a <5e79e0180515b31b2e2244dc3d256fd8b5a07021 || >=ac338acf514e7b578fa9e3742ec2c292323b4c1a <860885fcd2611bca8c28dac8b2c1c7ff160f763e || >=ac338acf514e7b578fa9e3742ec2c292323b4c1a <cc77f0d91e3214e4292208f02a1dc09a31f9aac7 || >=ac338acf514e7b578fa9e3742ec2c292323b4c1a <9b0f4082a09760939588135d60a8e9cc994bfa3e || >=ac338acf514e7b578fa9e3742ec2c292323b4c1a <e9506871a8ea304cde48ff4a57226df2aadddae3 || 6d88283a49425eb469aa60ffebe76539e73c933e || >=5.5.13 <5.6 | 89789e4c141904506163dcb91c7289a074573931, 51b3e1de53ee5b7775c7ff90e67fdb2665fce938, 358697929351f619143f59c6a8a15a4994748b79, 5e79e0180515b31b2e2244dc3d256fd8b5a07021, 860885fcd2611bca8c28dac8b2c1c7ff160f763e, cc77f0d91e3214e4292208f02a1dc09a31f9aac7, 9b0f4082a09760939588135d60a8e9cc994bfa3e, e9506871a8ea304cde48ff4a57226df2aadddae3, 5.6 |
| Linux/Linuxgeneric | 5.6 | Not reported |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
In the Linux kernel, the following vulnerability has been resolved: driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() dev_has_sync_state() reads dev->driver twice without holding device_lock() -- once for the NULL check and once to dereference ->sync_state. Some callers only hold device_links_write_lock, which doesn't prevent a concurrent unbind from clearing dev->driver via device_unbind_cleanup(). Fix it by reading dev->driver exactly once with READ_ONCE(), pairing with the WRITE_ONCE() in device_set_driver().
Quoted source text, attributed separately from HOL analysis.