CVE-2026-80676 is a vulnerability in Linux Kernel
Published on August 28, 2026
Drivers: hv: vmbus: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: vmbus: use generic driver_override infrastructure
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
Products Associated with CVE-2026-80676
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version d765edbb301c0e196015a59b17420558088ea33f and below d1cb12ae81d2f7a58b0b1cfb51862afca98e6058 is affected.
- Version d765edbb301c0e196015a59b17420558088ea33f and below 0e2f0833556c8c5269deb457b89d538644a3b747 is affected.
- Version d765edbb301c0e196015a59b17420558088ea33f and below 2fb010ea7ca98cd09a6d365260b769f627e73a76 is affected.
- Version d765edbb301c0e196015a59b17420558088ea33f and below 331d8900121a1d74ecd45cd2db742ddcb5a0a565 is affected.
- Version 4.20 is affected.
- Before 4.20 is unaffected.
- Version 6.12.97, <= 6.12.* is unaffected.
- Version 6.18.40, <= 6.18.* is unaffected.
- Version 7.1.5, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.