CVE-2026-80661

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80661", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.781Z", "datePublished": "2026-08-28T06:49:05.685Z", "dateUpdated": "2026-08-29T06:21:46.376Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:21:46.376Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nufs: core: tracing: Do not dereference pointers in TP_printk()\n\nThe trace events in drivers/ufs/core/ufs_trace.h were converted to take a\npointer to the hba structure as an argument for the tracepoint and then in\nTP_printk() the printing of the dev_name from the ring buffer was\nconverted to using the dev dereferenced pointer from the hba saved\npointer.\n\nThis is not allowed as the TP_printk() is executed at the time the trace\nevent is read from /sys/kernel/tracing/trace file. That can happen\nliterally, seconds, minutes, hours, weeks, days, or even months later!\nThere is no guarantee that the hba pointer will still exist by the time it\nis dereferenced when the \"trace\" file is read.\n\nInstead, save the device name from the hba pointer at the time the\ntracepoint is called and place it into the ring buffer event. Then the\nTP_printk() can read the name directly from the ring buffer and remove the\npossibility that it will read a freed pointer and crash the kernel.\n\nThis was detected when testing the trace event code that looks for\nTP_printk() parameters doing illegal derferences[1]\n\n[1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF fires only when a local actor reads formatted UFS trace events from tracefs (/sys/kernel/tracing/trace or trace_pipe); UFS I/O merely records ring-buffer entries and provides no network, adjacent-radio, or physical-device entry to TP_printk().\nAC:L - An attacker with tracefs access controls the full sequence\u2014enable ufs trace events, generate UFS storage I/O to record hba/sdev pointers, unbind/remove the UFS host driver so those objects are freed, then read trace to deterministically hit the stale dereference without uncontrollable races.\nPR:L - Exploitation requires local tracefs read/write to enable ufs events and read formatted output; tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC (no capable()), and tracing-gid delegation on Android eng/atrace, ChromeOS, and developer kernels grants this to non-root accounts, matching prior TP_printk UAF CVEs.\nUI:N - No victim interaction is required; the attacker (or same debug account) enables UFS tracing, exercises or waits for UFS activity, triggers or observes driver teardown, and reads the trace buffer themselves to invoke the vulnerable TP_printk() formatting path.\nS:U - Impact is confined to kernel memory corruption, information disclosure, and denial of service within the host OS; this is standard local kernel privilege/availability impact with no VM escape, IOMMU bypass, or other cross-security-authority boundary crossing.\nC:H - TP_printk() dereferences freed hba->dev or sdev->sdev_dev via dev_name() when formatting trace output, reading stale/reused slab memory into the userspace-visible trace buffer; per kernel CNA guidance, this deferred UAF read path warrants High confidentiality impact.\nI:H - The bug is a use-after-free on kernel heap objects (ufs_hba/scsi_device) whose freed memory can be attacker-influenced through driver teardown and reallocations before trace read, enabling heap grooming and potential write/control-flow primitives beyond a read-only format string, not merely a benign crash.\nA:H - Dereferencing freed hba or scsi_device structures during trace formatting causes kernel paging faults/oopses and can panic the system; the fix explicitly states this illegal TP_printk() dereference can crash the kernel when the trace file is read after device removal."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/core/ufs_trace.h"], "versions": [{"version": "583e518e7100362e3937b583976f9470c39d1db2", "lessThan": "e497fef9ad7e913f52de6f97e818f56915e96164", "status": "affected", "versionType": "git"}, {"version": "583e518e7100362e3937b583976f9470c39d1db2", "lessThan": "2510434307a224078302019e52ab3c863fbe87fb", "status": "affected", "versionType": "git"}, {"version": "583e518e7100362e3937b583976f9470c39d1db2", "lessThan": "535fcf4b8a261fbb8cc4f91e4597343c135a90f2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/core/ufs_trace.h"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e497fef9ad7e913f52de6f97e818f56915e96164"}, {"url": "https://git.kernel.org/stable/c/2510434307a224078302019e52ab3c863fbe87fb"}, {"url": "https://git.kernel.org/stable/c/535fcf4b8a261fbb8cc4f91e4597343c135a90f2"}], "title": "ufs: core: tracing: Do not dereference pointers in TP_printk()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/ufs/core/ufs_trace.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e497fef9ad7e913f52de6f97e818f56915e96164", "status": "affected", "version": "583e518e7100362e3937b583976f9470c39d1db2", "versionType": "git"}, {"lessThan": "2510434307a224078302019e52ab3c863fbe87fb", "status": "affected", "version": "583e518e7100362e3937b583976f9470c39d1db2", "versionType": "git"}, {"lessThan": "535fcf4b8a261fbb8cc4f91e4597343c135a90f2", "status": "affected", "version": "583e518e7100362e3937b583976f9470c39d1db2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/ufs/core/ufs_trace.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nufs: core: tracing: Do not dereference pointers in TP_printk()\n\nThe trace events in drivers/ufs/core/ufs_trace.h were converted to take a\npointer to the hba structure as an argument for the tracepoint and then in\nTP_printk() the printing of the dev_name from the ring buffer was\nconverted to using the dev dereferenced pointer from the hba saved\npointer.\n\nThis is not allowed as the TP_printk() is executed at the time the trace\nevent is read from /sys/kernel/tracing/trace file. That can happen\nliterally, seconds, minutes, hours, weeks, days, or even months later!\nThere is no guarantee that the hba pointer will still exist by the time it\nis dereferenced when the \"trace\" file is read.\n\nInstead, save the device name from the hba pointer at the time the\ntracepoint is called and place it into the ring buffer event. Then the\nTP_printk() can read the name directly from the ring buffer and remove the\npossibility that it will read a freed pointer and crash the kernel.\n\nThis was detected when testing the trace event code that looks for\nTP_printk() parameters doing illegal derferences[1]\n\n[1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/"}], "id": "CVE-2026-80661", "lastModified": "2026-08-29T07:16:48.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-28T08:16:51.290", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2510434307a224078302019e52ab3c863fbe87fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/535fcf4b8a261fbb8cc4f91e4597343c135a90f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e497fef9ad7e913f52de6f97e818f56915e96164"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ufs: core: tracing: Do not dereference pointers in TP_printk()", "id": "2525368", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525368"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nufs: core: tracing: Do not dereference pointers in TP_printk()\nThe trace events in drivers/ufs/core/ufs_trace.h were converted to take a\npointer to the hba structure as an argument for the tracepoint and then in\nTP_printk() the printing of the dev_name from the ring buffer was\nconverted to using the dev dereferenced pointer from the hba saved\npointer.\nThis is not allowed as the TP_printk() is executed at the time the trace\nevent is read from /sys/kernel/tracing/trace file. That can happen\nliterally, seconds, minutes, hours, weeks, days, or even months later!\nThere is no guarantee that the hba pointer will still exist by the time it\nis dereferenced when the \"trace\" file is read.\nInstead, save the device name from the hba pointer at the time the\ntracepoint is called and place it into the ring buffer event. Then the\nTP_printk() can read the name directly from the ring buffer and remove the\npossibility that it will read a freed pointer and crash the kernel.\nThis was detected when testing the trace event code that looks for\nTP_printk() parameters doing illegal derferences[1]\n[1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/", "A flaw was found in the Linux kernel's Universal Flash Storage (UFS) core tracing module. The system attempts to access a memory location that has already been freed when processing trace events, specifically within the `TP_printk()` function. This use-after-free vulnerability can be triggered when reading trace events, potentially leading to a system crash and a denial of service."], "name": "CVE-2026-80661", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80661\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80661\nhttps://lore.kernel.org/linux-cve-announce/2026082846-CVE-2026-80661-52f4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[583e518e7100362e3937b583976f9470c39d1db2,e497fef9ad7e913f52de6f97e818f56915e96164)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[583e518e7100362e3937b583976f9470c39d1db2,2510434307a224078302019e52ab3c863fbe87fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[583e518e7100362e3937b583976f9470c39d1db2,535fcf4b8a261fbb8cc4f91e4597343c135a90f2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T12:15:04.646074+00:00", "updated": "2026-08-31T13:45:04.186542+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}