01 Record

CVE-2026-80677

driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.17% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 7.0% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-16.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-08-28 06:49Z2 MO AGO

Last updated

2026-10-16 19:26Z12 DAYS AGO

Reserved

2026-08-26

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-476NULL Pointer DereferenceBase

Data version

5.2

Document digest

08318b21c20230b32dc9988ddd97a68eee40633da9614b2970b55d6d05aab452

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxac338acf514e7b578fa9e3742ec2c292323b4c1a to < 89789e4c141904506163dcb91c7289a074573931, ac338acf514e7b578fa9e3742ec2c292323b4c1a to < 51b3e1de53ee5b7775c7ff90e67fdb2665fce938, ac338acf514e7b578fa9e3742ec2c292323b4c1a to < 358697929351f619143f59c6a8a15a4994748b79, ac338acf514e7b578fa9e3742ec2c292323b4c1a to < 5e79e0180515b31b2e2244dc3d256fd8b5a07021, ac338acf514e7b578fa9e3742ec2c292323b4c1a to < 860885fcd2611bca8c28dac8b2c1c7ff160f763e, ac338acf514e7b578fa9e3742ec2c292323b4c1a to < cc77f0d91e3214e4292208f02a1dc09a31f9aac7, ac338acf514e7b578fa9e3742ec2c292323b4c1a to < 9b0f4082a09760939588135d60a8e9cc994bfa3e, ac338acf514e7b578fa9e3742ec2c292323b4c1a to < e9506871a8ea304cde48ff4a57226df2aadddae3, 6d88283a49425eb469aa60ffebe76539e73c933e, 5.5.13 to < 5.6, 5.6—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/89789e4c141904506163dcb91c7289a074573931
git.kernel.orghttps://git.kernel.org/stable/c/51b3e1de53ee5b7775c7ff90e67fdb2665fce938
git.kernel.orghttps://git.kernel.org/stable/c/358697929351f619143f59c6a8a15a4994748b79
git.kernel.orghttps://git.kernel.org/stable/c/5e79e0180515b31b2e2244dc3d256fd8b5a07021
git.kernel.orghttps://git.kernel.org/stable/c/860885fcd2611bca8c28dac8b2c1c7ff160f763e
git.kernel.orghttps://git.kernel.org/stable/c/cc77f0d91e3214e4292208f02a1dc09a31f9aac7
git.kernel.orghttps://git.kernel.org/stable/c/9b0f4082a09760939588135d60a8e9cc994bfa3e
git.kernel.orghttps://git.kernel.org/stable/c/e9506871a8ea304cde48ff4a57226df2aadddae3

07 Fixed in

Debian 12

linux
Fixed in 6.1.180-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.100-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.