CVE-2026-80923

In the Linux kernel, the following vulnerability has been resolved:

xhci: dbgtty: Fix unregister on tty register driver() failure

If tty register driver() fails, it drops the reference, but fails to set the global dbc tty driver to NULL, causing the unregister to be called again when module exits.

On module unload dbc tty exit() only gates its cleanup on the driver pointer being non-NULL, so it operates on the already-freed driver:

module init(xhci hcd init) xhci hcd init() xhci dbc init() [return value ignored] dbc tty init() tty register driver() fails tty driver kref put() -> driver freed (dbc tty driver left dangling) ... module exit(xhci hcd fini) xhci hcd fini() xhci dbc exit() dbc tty exit() if (dbc tty driver) -> true (dangling) tty unregister driver() -> use-after-free