PT-2026-82922 · Linux · Linux
CVE-2026-80622
·
Published
2026-08-28
·
Updated
2026-08-28
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
char: tlclk: fix use-after-free in tlclk cleanup()
This patch improves the module cleanup process in the tlclk driver to
prevent potential use-after-free and race conditions.
Currently, the file operations structure does not specify the .owner
field, which could allow the module to be unloaded while user-space
processes are still interacting with the device. Additionally, the
tlclk cleanup() function frees the alarm events memory before ensuring
that blocked processes in the waitqueue are fully awakened and that the
switchover timer has completed.
To address these cases, this patch:
- Sets '.owner = THIS MODULE' in tlclk fops to safely defer module unloading while the device is in use.
- Updates tlclk cleanup() to explicitly wake up all blocked readers (wake up all), properly release hardware I/O regions, and safely delete the timer (timer delete sync) prior to freeing memory.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux