CVE-2026-80622

char: tlclk: fix use-after-free in tlclk_cleanup()

HIGH
7.8
CVSS Score
Published: August 28, 2026 at 06:48 AM UTC
Updated: October 16, 2026 at 08:18 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup() This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the file_operations structure does not specify the .owner field, which could allow the module to be unloaded while user-space processes are still interacting with the device. Additionally, the tlclk_cleanup() function frees the alarm_events memory before ensuring that blocked processes in the waitqueue are fully awakened and that the switchover_timer has completed. To address these cases, this patch: - Sets '.owner = THIS_MODULE' in tlclk_fops to safely defer module unloading while the device is in use. - Updates tlclk_cleanup() to explicitly wake up all blocked readers (wake_up_all), properly release hardware I/O regions, and safely delete the timer (timer_delete_sync) prior to freeing memory.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

1a80ba88273097933f93b1f40537337416798c702.6.15
Vendor states this is fixed in 09d8d2a46a9ec9ff728f3159a174a2ab25dd0f0a (fixed)
Vendor states this is fixed in 166dd1d5265e067459e674c11688919901813ec2 (fixed)
Vendor states this is fixed in 3d5e4cc0d9dce79b0429da3134ac7b072ab9009f (fixed)
Vendor states this is fixed in 42223445607a9a5df3cb1c4729abfe3a5085e7ce (fixed)
Vendor states this is fixed in 764723bd67a6c8f53a8d8309211fb039e2ebcf49 (fixed)
Vendor states this is fixed in 96902299a22d126ef5eb3f45cd5d8ceea9e6a735 (fixed)
Vendor states this is fixed in bbf003b7794d6ad6f939fdd29f1f1bde8ac554c1 (fixed)
Vendor states this is fixed in c3f0cd76561ae611c2d247ee96dfd559e4197cb7 (fixed)
Vendor states this is fixed in 2.6.15 (unaffected)
Vendor states this is fixed in 5.10.261 (unaffected)
Vendor states this is fixed in 5.15.212 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.97 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card