CVE-2026-80923

xhci: dbgtty: Fix unregister on tty_register_driver() failure

Published Sep 9, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

xhci: dbgtty: Fix unregister on tty_register_driver() failure

If tty_register_driver() fails, it drops the reference, but fails to set
the global dbc_tty_driver to NULL, causing the unregister to be called
again when module exits.

On module unload dbc_tty_exit() only gates its cleanup on the driver
pointer being non-NULL, so it operates on the already-freed driver:

module_init(xhci_hcd_init)
xhci_hcd_init()
xhci_dbc_init() [return value ignored]
dbc_tty_init()
tty_register_driver() fails
tty_driver_kref_put() -> driver freed
(dbc_tty_driver left dangling)
...
module_exit(xhci_hcd_fini)
xhci_hcd_fini()
xhci_dbc_exit()
dbc_tty_exit()
if (dbc_tty_driver) -> true (dangling)
tty_unregister_driver() -> use-after-free

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4521f16139409cdf9462c7325d43454462cff6c3`	affected	< 01b7bc0938061f2fd46e0094f6483d8c6c02f7d3
`4521f16139409cdf9462c7325d43454462cff6c3`	affected	< 43635ff6401ca0e0ed21875379eeded921321525
`4521f16139409cdf9462c7325d43454462cff6c3`	affected	< eaca2814f32b9872a332326324b9e83e01f156d2
`4521f16139409cdf9462c7325d43454462cff6c3`	affected	< 943f976c93e70563b132f5585ff68b08c89641a2
`4521f16139409cdf9462c7325d43454462cff6c3`	affected	< 0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922
`4521f16139409cdf9462c7325d43454462cff6c3`	affected	< 33ed35ca629477f57e0dd1d77d6df96cf5a9eb55
`4521f16139409cdf9462c7325d43454462cff6c3`	affected	< 0e469b94fbba8eb03666da41dd1082b793c50c1a
`4521f16139409cdf9462c7325d43454462cff6c3`	affected	< a916fa66a43e10f63198b6ce978badffc678821a

Linux

affected

Version	Status	Constraints
`5.9`	affected	—
`0`	unaffected	< 5.9
`5.15.220`	unaffected	≤ 5.15.*
`6.1.187`	unaffected	≤ 6.1.*
`6.6.156`	unaffected	≤ 6.6.*
`6.12.108`	unaffected	≤ 6.12.*
`6.18.49`	unaffected	≤ 6.18.*
`7.1.13`	unaffected	≤ 7.1.*
`7.2.3`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[4521f16139409cdf9462c7325d43454462cff6c3,01b7bc0938061f2fd46e0094f6483d8c6c02f7d3)`	affected	code_commit	—
`[4521f16139409cdf9462c7325d43454462cff6c3,43635ff6401ca0e0ed21875379eeded921321525)`	affected	code_commit	—
`[4521f16139409cdf9462c7325d43454462cff6c3,eaca2814f32b9872a332326324b9e83e01f156d2)`	affected	code_commit	—
`[4521f16139409cdf9462c7325d43454462cff6c3,943f976c93e70563b132f5585ff68b08c89641a2)`	affected	code_commit	—
`[4521f16139409cdf9462c7325d43454462cff6c3,0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922)`	affected	code_commit	—
`[4521f16139409cdf9462c7325d43454462cff6c3,33ed35ca629477f57e0dd1d77d6df96cf5a9eb55)`	affected	code_commit	—
`[4521f16139409cdf9462c7325d43454462cff6c3,0e469b94fbba8eb03666da41dd1082b793c50c1a)`	affected	code_commit	—
`[4521f16139409cdf9462c7325d43454462cff6c3,a916fa66a43e10f63198b6ce978badffc678821a)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.9`	affected	generic	—
`[0,5.9)`	unaffected	generic	—
`[5.15.220,5.16.0)`	unaffected	semver	—
`[6.1.187,6.2.0)`	unaffected	semver	—
`[6.6.156,6.7.0)`	unaffected	semver	—
`[6.12.108,6.13.0)`	unaffected	semver	—
`[6.18.49,6.19.0)`	unaffected	semver	—
`[7.1.13,7.2.0)`	unaffected	semver	—
`[7.2.3,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.165% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/01b7bc0938061f2fd46e0094f6483d8c6c02f7d3
https://git.kernel.org/stable/c/0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922
https://git.kernel.org/stable/c/0e469b94fbba8eb03666da41dd1082b793c50c1a
https://git.kernel.org/stable/c/33ed35ca629477f57e0dd1d77d6df96cf5a9eb55
https://git.kernel.org/stable/c/43635ff6401ca0e0ed21875379eeded921321525
https://git.kernel.org/stable/c/943f976c93e70563b132f5585ff68b08c89641a2
https://git.kernel.org/stable/c/a916fa66a43e10f63198b6ce978badffc678821a
https://git.kernel.org/stable/c/eaca2814f32b9872a332326324b9e83e01f156d2

History

Sep 9, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver() failure If tty_register_driver() fails, it drops the reference, but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when module exits. On module unload dbc_tty_exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver: module_init(xhci_hcd_init) xhci_hcd_init() xhci_dbc_init() [return value ignored] dbc_tty_init() tty_register_driver() fails tty_driver_kref_put() -> driver freed (dbc_tty_driver left dangling) ... module_exit(xhci_hcd_fini) xhci_hcd_fini() xhci_dbc_exit() dbc_tty_exit() if (dbc_tty_driver) -> true (dangling) tty_unregister_driver() -> use-after-free
Title		xhci: dbgtty: Fix unregister on tty_register_driver() failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01b7bc0938061f2fd46e0094f6483d8c6c02f7d3 https://git.kernel.org/stable/c/0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922 https://git.kernel.org/stable/c/0e469b94fbba8eb03666da41dd1082b793c50c1a https://git.kernel.org/stable/c/33ed35ca629477f57e0dd1d77d6df96cf5a9eb55 https://git.kernel.org/stable/c/43635ff6401ca0e0ed21875379eeded921321525 https://git.kernel.org/stable/c/943f976c93e70563b132f5585ff68b08c89641a2 https://git.kernel.org/stable/c/a916fa66a43e10f63198b6ce978badffc678821a https://git.kernel.org/stable/c/eaca2814f32b9872a332326324b9e83e01f156d2