{"id":"CVE-2026-80676","title":"Drivers: hv: vmbus: use generic driver_override infrastructure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the devic…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d765edbb301c0e196015a59b17420558088ea33f < a1656234a4a2dc6e975546867887c5f63e4a90f0","Linux >= d765edbb301c0e196015a59b17420558088ea33f < d1cb12ae81d2f7a58b0b1cfb51862afca98e6058","Linux >= d765edbb301c0e196015a59b17420558088ea33f < 0e2f0833556c8c5269deb457b89d538644a3b747","Linux >= d765edbb301c0e196015a59b17420558088ea33f < 2fb010ea7ca98cd09a6d365260b769f627e73a76","Linux >= d765edbb301c0e196015a59b17420558088ea33f < 331d8900121a1d74ecd45cd2db742ddcb5a0a565","Linux 4.20"],"published":"2026-08-28","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:46:51.475Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80676","references":[{"url":"https://git.kernel.org/stable/c/a1656234a4a2dc6e975546867887c5f63e4a90f0"},{"url":"https://git.kernel.org/stable/c/d1cb12ae81d2f7a58b0b1cfb51862afca98e6058"},{"url":"https://git.kernel.org/stable/c/0e2f0833556c8c5269deb457b89d538644a3b747"},{"url":"https://git.kernel.org/stable/c/2fb010ea7ca98cd09a6d365260b769f627e73a76"},{"url":"https://git.kernel.org/stable/c/331d8900121a1d74ecd45cd2db742ddcb5a0a565"}],"tags":["cve.org"],"epss":0.00209,"epssPercentile":0.10422,"ingestedAt":"2026-10-21T12:48:53.751Z","slug":"CVE-2026-80676","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\n## Affected\n\n- `Linux >= d765edbb301c0e196015a59b17420558088ea33f < a1656234a4a2dc6e975546867887c5f63e4a90f0`\n- `Linux >= d765edbb301c0e196015a59b17420558088ea33f < d1cb12ae81d2f7a58b0b1cfb51862afca98e6058`\n- `Linux >= d765edbb301c0e196015a59b17420558088ea33f < 0e2f0833556c8c5269deb457b89d538644a3b747`\n- `Linux >= d765edbb301c0e196015a59b17420558088ea33f < 2fb010ea7ca98cd09a6d365260b769f627e73a76`\n- `Linux >= d765edbb301c0e196015a59b17420558088ea33f < 331d8900121a1d74ecd45cd2db742ddcb5a0a565`\n- `Linux 4.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}