{"cve":"CVE-2026-80923","nvd":{"published":"2026-09-09T17:17:47.507","modified":"2026-10-19T09:17:23.200","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: dbgtty: Fix unregister on tty_register_driver() failure\n\nIf tty_register_driver() fails, it drops the reference, but fails to set\nthe global dbc_tty_driver to NULL, causing the unregister to be called\nagain when module exits.\n\nOn module unload dbc_tty_exit() only gates its cleanup on the driver\npointer being non-NULL, so it operates on the already-freed driver:\n\n    module_init(xhci_hcd_init)\n      xhci_hcd_init()\n        xhci_dbc_init()                       [return value ignored]\n          dbc_tty_init()\n            tty_register_driver() fails\n              tty_driver_kref_put()           -> driver freed\n              (dbc_tty_driver left dangling)\n    ...\n    module_exit(xhci_hcd_fini)\n      xhci_hcd_fini()\n        xhci_dbc_exit()\n          dbc_tty_exit()\n            if (dbc_tty_driver)               -> true (dangling)\n              tty_unregister_driver()         -> use-after-free","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/01b7bc0938061f2fd46e0094f6483d8c6c02f7d3","https://git.kernel.org/stable/c/0d0faf3cc44c4d86fc6faf5cea972c0fbe00b922","https://git.kernel.org/stable/c/0e469b94fbba8eb03666da41dd1082b793c50c1a","https://git.kernel.org/stable/c/33ed35ca629477f57e0dd1d77d6df96cf5a9eb55","https://git.kernel.org/stable/c/43635ff6401ca0e0ed21875379eeded921321525"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:52:53.108888569+00:00"},"epss":{"cve":"CVE-2026-80923","score":0.00165,"percentile":0.05618,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}