CVE-2026-80622

The tlclk character driver in the Linux kernel mishandles module teardown: tlclk_fops lacks an .owner field and tlclk_cleanup() frees alarm_events without first waking blocked waiters and synchronously stopping the switchover_timer, allowing a use-after-free and race conditions if the device is closed or the module unloaded while user-space processes are still interacting with it. A local, low-privileged attacker or process racing the cleanup path could corrupt freed memory, potentially leading to a kernel crash or local privilege escalation. The flaw only matters on Linux systems where the tlclk (telco clock, CONFIG_TELCLOCK) driver is built and used, which is tied to rare telecom clocking hardware. There are no known public exploits, proof-of-concepts, or CISA KEV entries, and EPSS puts the 30-day exploitation probability at about 0.1%.

What to do: Update the Linux kernel to a build containing the tlclk fix as it is merged into your distribution's stable/long-term branches; do not rely on version numbers beyond that until vendors publish patched releases. Check whether /dev/telclk exists or CONFIG_TELCLOCK is enabled in running kernels; if the telco clock hardware is not in use, disable, unload or blacklist the driver. Given the local attack vector, standard controls restricting unprivileged local shell access on exposed hosts also reduce risk.