CVE-2026-80923

xhci: dbgtty: Fix unregister on tty_register_driver() failure

State: Published
Severity: Not scored
Published: Sep 9, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xhci: dbgtty: Fix unregister on tty_register_driver() failure

If tty_register_driver() fails, it drops the reference, but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when module exits.

On module unload dbc_tty_exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver:

module_init(xhci_hcd_init) xhci_hcd_init() xhci_dbc_init() [return value ignored] dbc_tty_init() tty_register_driver() fails tty_driver_kref_put() -> driver freed (dbc_tty_driver left dangling) ... module_exit(xhci_hcd_fini) xhci_hcd_fini() xhci_dbc_exit() dbc_tty_exit() if (dbc_tty_driver) -> true (dangling) tty_unregister_driver() -> use-after-free

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4521f16139409cdf9462c7325d43454462cff6c3 to before 01b7bc0938061f2fd46e0094f6483d8c6c02f7d3Affected 4521f16139409cdf9462c7325d43454462cff6c3 to before 43635ff6401ca0e0ed21875379eeded921321525Affected 4521f16139409cdf9462c7325d43454462cff6c3 to before eaca2814f32b9872a332326324b9e83e01f156d2Affected 4521f16139409cdf9462c7325d43454462cff6c3 to before 943f976c93e70563b132f5585ff68b08c89641a2Affected 4521f16139409cdf9462c7325d43454462cff6c3 to before 0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922Affected 4521f16139409cdf9462c7325d43454462cff6c3 to before 33ed35ca629477f57e0dd1d77d6df96cf5a9eb55Affected 4521f16139409cdf9462c7325d43454462cff6c3 to before 0e469b94fbba8eb03666da41dd1082b793c50c1aAffected 4521f16139409cdf9462c7325d43454462cff6c3 to before a916fa66a43e10f63198b6ce978badffc678821aAffected
LinuxLinux	5.9Affected before 5.9Not affected 5.15.220 through 5.15.Not affected 6.1.187 through 6.1.Not affected 6.6.156 through 6.6.Not affected 6.12.108 through 6.12.Not affected 6.18.49 through 6.18.Not affected 7.1.13 through 7.1.Not affected 7.2.3 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4521f16139409cdf9462c7325d43454462cff6c3 to before 01b7bc0938061f2fd46e0094f6483d8c6c02f7d3Affected
4521f16139409cdf9462c7325d43454462cff6c3 to before 43635ff6401ca0e0ed21875379eeded921321525Affected
4521f16139409cdf9462c7325d43454462cff6c3 to before eaca2814f32b9872a332326324b9e83e01f156d2Affected
4521f16139409cdf9462c7325d43454462cff6c3 to before 943f976c93e70563b132f5585ff68b08c89641a2Affected
4521f16139409cdf9462c7325d43454462cff6c3 to before 0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922Affected
4521f16139409cdf9462c7325d43454462cff6c3 to before 33ed35ca629477f57e0dd1d77d6df96cf5a9eb55Affected
4521f16139409cdf9462c7325d43454462cff6c3 to before 0e469b94fbba8eb03666da41dd1082b793c50c1aAffected
4521f16139409cdf9462c7325d43454462cff6c3 to before a916fa66a43e10f63198b6ce978badffc678821aAffected

LinuxLinux

5.9Affected
before 5.9Not affected
5.15.220 through 5.15.*Not affected
6.1.187 through 6.1.*Not affected
6.6.156 through 6.6.*Not affected
6.12.108 through 6.12.*Not affected
6.18.49 through 6.18.*Not affected
7.1.13 through 7.1.*Not affected
7.2.3 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.