CVE-2026-80677

dev_has_sync_state() in the Linux kernel driver core reads dev->driver twice without holding device_lock(); a concurrent device unbind can clear the pointer between the two reads, leading to a use-after-free or NULL dereference. The race is triggered when a caller holding only device_links_write_lock checks a device's sync_state while another task simultaneously unbinds the device's driver via device_unbind_cleanup(). A local attacker able to hit the race window could obtain memory corruption with high confidentiality, integrity, and availability impact, reflected in the CVSS 3.1 score of 7.8 (AV:L/PR:L). Any Linux kernel deployment containing the affected driver core code is theoretically exposed, though exploitation requires local access and precise timing. Exploitation status: no public proof-of-concept, no CISA KEV listing, and EPSS estimates only a 0.1% probability of exploitation within 30 days.

What to do: Deploy kernel updates from your distribution or vendor that include the driver core fix (READ_ONCE() on dev->driver in dev_has_sync_state() paired with WRITE_ONCE() in device_set_driver()); no specific fixed version number is provided in the source data, so verify with your vendor's kernel advisory. Because exploitation requires local access, restrict untrusted local code execution on critical systems as an interim mitigation and monitor kernel and EPSS updates for changes in exploit status.