Cloudanix VulnDB

CVE-2026-80830

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in how Linux handles USB device notifications could let an attacker with physical access crash the computer or take control of it.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in usb_wakeup_notification allows concurrent dereference of freed device state when xHCI IRQ path races with hub_disconnect, resulting in use-after-free.

Why it matters to the business

Potential kernel crashes, denial of service, or local privilege escalation on Linux systems handling USB devices, increasing operational downtime and security risk in environments with frequent USB activity.

How an attack unfolds

An attacker with local access triggers rapid USB connect/disconnect events or crafts device interactions that cause the xHCI driver to invoke usb_wakeup_notification from interrupt context while hub_disconnect frees associated memory, leading to the race and potential arbitrary code execution or crash.

How to fix it

Update to a Linux kernel version containing the spinlock addition in usb_wakeup_notification; apply vendor-supplied kernel updates as they become available.

How to confirm the fix worked

Confirm kernel source contains the added spinlock protecting device state in usb_wakeup_notification and hub_disconnect paths; test USB attach/detach under load for absence of use-after-free reports in kernel logs.

Typical attack path

  1. Obtain local access on target Linux system
  2. Trigger USB device events via physical or virtual USB manipulation
  3. Race hub_disconnect memory release against IRQ-driven wakeup notification
  4. Exploit resulting use-after-free for memory corruption or control-flow hijack

How to detect it

Review kernel logs for use-after-free warnings or oops traces involving usb_wakeup_notification or hub_disconnect; inspect for repeated USB event patterns coinciding with crashes.

What your security team should do

  • Prioritize kernel updates on systems exposed to untrusted USB devices
  • Monitor vendor advisories for backported fixes in supported distributions
  • Restrict physical USB access where feasible until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: usb: core: Add lock to usb_wakeup_notification() Add a spin lock to usb_wakeup notification to prevent a race condition with dereferencing freed memory. This could be hit by the xHCI driver as it calls this function from an IRQ and could race with the hub_disconnect() function, which properly grabs this lock to protect the state of the device.

Affected packages

Ecosystem Package Introduced Fixed