{"id":"CVE-2026-80660","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-80660","generatedAt":"2026-10-28T03:39:17.693Z","title":"In the Linux kernel, the following vulnerability has been resolved: hwmon: (occ) unregister sysfs devices outside occ lock occ_active(false) and occ_shutdown() unregister sysfs-backed devices while occ->lock is held. hwmon_device_unregister() and…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (occ) unregister sysfs devices outside occ lock\n\nocc_active(false) and occ_shutdown() unregister sysfs-backed devices while\nocc->lock is held.  hwmon_device_unregister() and sysfs_remove_group() can\nwait for active sysfs callbacks to drain, and those callbacks can enter the\nOCC update path and try to take occ->lock again.  That gives the unregister\npaths the lock ordering occ->lock -> sysfs callback drain, while a callback\nhas the opposite edge sysfs callback -> occ->lock.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the real unregister and callback carrier:\n\n  occ_shutdown()\n  hwmon_device_unregister()\n  occ_show_temp_1()\n  occ_update_response()\n\nLockdep reported the circular dependency with occ_shutdown() already\nholding the OCC mutex and hwmon_device_unregister() waiting on the sysfs\nside:\n\n  WARNING: possible circular locking dependency detected\n  ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]\n  ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]\n  occ_update_response.isra.0+0xb/0x20 [vuln_msv]\n  occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]\n  *** DEADLOCK ***\n\nSerialize hwmon registration and removal with a separate hwmon_lock.\nUnder that lock, detach occ->hwmon and update occ->active while occ->lock\nis held so concurrent OCC state changes still see a stable state, then\ndrop occ->lock before calling hwmon_device_unregister().  Remove the\ndriver sysfs group before taking occ->lock in occ_shutdown(), so draining\nthe driver attributes cannot wait while the OCC mutex is held.  Also make\nOCC update callbacks return -ENODEV after deactivation, so callbacks that\nalready passed sysfs active protection do not poll the hardware after\nteardown has detached the hwmon device.","published":"2026-08-28T08:16:51.000Z","lastModified":"2026-08-28T08:16:51.000Z","status":"Received","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":null,"cwe":[],"affected":[],"epss":{"score":0.00215,"percentile":0.11761,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/2092952f22a7da98e76e84139ae202b1fc7ba899","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a4c80ff3571498ec6a916273304b6650026b1b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ee43ec8e6774774abbe9dc3027225e01bc964a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e31408734332b8cc611342cdaaab6ba492180156","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7fd81e9fb1fe476d2131fec66c1138457810ed4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0aad157576da199c146c1bb266442befa7912ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-80660","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}