CVE-2026-80660

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (occ) unregister sysfs devices outside occ lock

occ_active(false) and occ_shutdown() unregister sysfs-backed devices while

occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can

wait for active sysfs callbacks to drain, and those callbacks can enter the

OCC update path and try to take occ->lock again. That gives the unregister

paths the lock ordering occ->lock -> sysfs callback drain, while a callback

has the opposite edge sysfs callback -> occ->lock.

This issue was found by our static analysis tool and then manually

reviewed against the current tree.

The grounded PoC kept the real unregister and callback carrier:

occ_shutdown()

hwmon_device_unregister()

occ_show_temp_1()

occ_update_response()

Lockdep reported the circular dependency with occ_shutdown() already

holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs

side:

WARNING: possible circular locking d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References