CVE-2026-80676

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match()

callback is called without the device lock held, thus accessing the

driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking

care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock

held is intentional. [1]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References