CVE-2026-80830

usb: core: Add lock to usb_wakeup_notification()

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: core: Add lock to usb_wakeup_notification()

Add a spin lock to usb_wakeup notification to prevent a race condition with dereferencing freed memory. This could be hit by the xHCI driver as it calls this function from an IRQ and could race with the hub_disconnect() function, which properly grabs this lock to protect the state of the device.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4ee823b83bc9851743fab756c76b27d6a1e2472b to before a7a16167991c88016acef720927400404039d850Affected 4ee823b83bc9851743fab756c76b27d6a1e2472b to before 975ef630393c07fcbebf94f4d97043161b77a6ceAffected 4ee823b83bc9851743fab756c76b27d6a1e2472b to before 71cfda2fdf78041a01e9d94143baa79feabbdbf6Affected 4ee823b83bc9851743fab756c76b27d6a1e2472b to before 04ab260407972e631c86f2bc576cd8e64d65b325Affected 4ee823b83bc9851743fab756c76b27d6a1e2472b to before bf2288583b4e072bdff17a233963619e4bc7a8b5Affected 4ee823b83bc9851743fab756c76b27d6a1e2472b to before d80b946804674069db7ce6657319a71cf8eeaa5aAffected 4ee823b83bc9851743fab756c76b27d6a1e2472b to before 960ca456faf61824b178f47967340300b24183dbAffected 4ee823b83bc9851743fab756c76b27d6a1e2472b to before 7c48aa0c1e79116b8af4b988d16ee29b427d6491Affected 4ee823b83bc9851743fab756c76b27d6a1e2472b to before e263e18a9e7b1ff3e7301f0801c6ff87c31adfb6Affected
LinuxLinux	3.4Affected before 3.4Not affected 5.10.269 through 5.10.Not affected 5.15.220 through 5.15.Not affected 6.1.187 through 6.1.Not affected 6.6.156 through 6.6.Not affected 6.12.108 through 6.12.Not affected 6.18.49 through 6.18.Not affected 7.1.13 through 7.1.Not affected 7.2.3 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4ee823b83bc9851743fab756c76b27d6a1e2472b to before a7a16167991c88016acef720927400404039d850Affected
4ee823b83bc9851743fab756c76b27d6a1e2472b to before 975ef630393c07fcbebf94f4d97043161b77a6ceAffected
4ee823b83bc9851743fab756c76b27d6a1e2472b to before 71cfda2fdf78041a01e9d94143baa79feabbdbf6Affected
4ee823b83bc9851743fab756c76b27d6a1e2472b to before 04ab260407972e631c86f2bc576cd8e64d65b325Affected
4ee823b83bc9851743fab756c76b27d6a1e2472b to before bf2288583b4e072bdff17a233963619e4bc7a8b5Affected
4ee823b83bc9851743fab756c76b27d6a1e2472b to before d80b946804674069db7ce6657319a71cf8eeaa5aAffected
4ee823b83bc9851743fab756c76b27d6a1e2472b to before 960ca456faf61824b178f47967340300b24183dbAffected
4ee823b83bc9851743fab756c76b27d6a1e2472b to before 7c48aa0c1e79116b8af4b988d16ee29b427d6491Affected
4ee823b83bc9851743fab756c76b27d6a1e2472b to before e263e18a9e7b1ff3e7301f0801c6ff87c31adfb6Affected

LinuxLinux

3.4Affected
before 3.4Not affected
5.10.269 through 5.10.*Not affected
5.15.220 through 5.15.*Not affected
6.1.187 through 6.1.*Not affected
6.6.156 through 6.6.*Not affected
6.12.108 through 6.12.*Not affected
6.18.49 through 6.18.*Not affected
7.1.13 through 7.1.*Not affected
7.2.3 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.