CVE-2026-80621: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80621 Overview

CVE-2026-80621 is a NULL pointer dereference vulnerability in the Linux kernel's DesignWare (DWC) PCIe controller driver. The flaw resides in the dwc_pcie_rasdes_debugfs_deinit() teardown path, which unconditionally dereferences pci->debugfs->rasdes_info. When the controller lacks Reliability, Availability and Serviceability Data Extended Sourcing (RAS DES) capability, dwc_pcie_rasdes_debugfs_init() returns success without allocating rasdes_info, leaving the pointer unset. The subsequent common debugfs teardown then dereferences the NULL pointer, triggering a kernel oops.

Critical Impact
Systems using DesignWare PCIe controllers without RAS DES capability can experience a kernel NULL pointer dereference during debugfs teardown, resulting in denial of service.

Affected Products

Linux kernel (mainline) with DesignWare PCIe controller driver enabled
Platforms using pcie-designware host controllers lacking RAS DES capability
Downstream distributions shipping the affected drivers/pci/controller/dwc code

Discovery Timeline

2026-08-28 - CVE-2026-80621 published to the National Vulnerability Database
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80621

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the DesignWare PCIe controller debugfs subsystem. The initialization function dwc_pcie_rasdes_debugfs_init() in drivers/pci/controller/dwc succeeds early when the controller reports no RAS DES capability. Because the success path skips allocation of the rasdes_info structure, the pci->debugfs->rasdes_info field remains uninitialized (NULL).

During driver teardown, the common debugfs cleanup logic invokes dwc_pcie_rasdes_debugfs_deinit() regardless of whether RAS DES was supported. That deinit function accesses fields inside rasdes_info, including a mutex intended for destruction. Dereferencing the NULL pointer in kernel context produces an oops and, depending on kernel configuration, a panic.

The fix modifies dwc_pcie_rasdes_debugfs_deinit() to return early when no RAS DES state was allocated. Since the RAS DES mutex is never initialized on unsupported controllers, no destruction work is required. The corrected teardown is now symmetric with the initialization path.

Root Cause

The root cause is an asymmetry between the RAS DES debugfs init and deinit paths. The init function returned success without allocating state on controllers lacking RAS DES capability, while the deinit function assumed state was always present. This violates the invariant that teardown must handle every state produced by initialization.

Attack Vector

The defect is triggered along the normal driver unbind or module unload code path on affected platforms. It does not require crafted network input or a remote attacker. On systems where an unprivileged user or automation can trigger PCIe driver teardown, the flaw becomes an availability issue. Consult the upstream commits 26b67fa10, 514b84b1, and 855870e8 for the precise source-level changes.

// No verified exploit code is available for this vulnerability.
// The defect manifests during driver teardown when rasdes_info is NULL.
// See the referenced upstream commits for the corrected control flow.

Detection Methods for CVE-2026-80621

Indicators of Compromise

Kernel oops or panic messages referencing dwc_pcie_rasdes_debugfs_deinit in dmesg or journalctl -k output.
NULL pointer dereference stack traces originating in drivers/pci/controller/dwc during module unload or device unbind.
Unexpected system reboots or hangs correlated with PCIe controller driver lifecycle events.

Detection Strategies

Audit kernel version and patch level on hosts running DesignWare PCIe controllers and compare against the fixed commits.
Parse kernel crash dumps for symbols in the dwc_pcie_rasdes namespace to identify affected teardown paths.
Monitor endpoint telemetry for repeated kernel faults tied to PCIe driver operations.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on BUG: or Oops: entries referencing PCIe DWC symbols.
Track driver unbind and module unload events on ARM64 and embedded platforms that commonly use DesignWare PCIe IP.
Correlate device hotplug and power-management events with kernel fault signatures to identify systematically vulnerable hosts.

How to Mitigate CVE-2026-80621

Immediate Actions Required

Update the Linux kernel to a version containing the upstream fixes referenced in commits 26b67fa10, 514b84b1, and 855870e8.
Track your distribution vendor's advisories for backported patches to long-term-support kernel branches.
Inventory systems that expose DesignWare PCIe controllers and prioritize patching those without RAS DES capability.

Patch Information

The fix returns early from dwc_pcie_rasdes_debugfs_deinit() when no RAS DES state was allocated, restoring symmetry with the init path. Apply the kernel updates from the upstream stable tree that include the three referenced commits, or rebuild affected kernels with the patches applied.

Workarounds

Avoid unbinding or unloading the affected pcie-designware driver on hosts lacking RAS DES capability until the patch is applied.
Restrict access to interfaces that trigger PCIe driver teardown, such as sysfs unbind and rmmod, to privileged administrators only.
Disable CONFIG_PCIE_DW_DEBUGFS on custom kernel builds where debugfs support for the DWC driver is not required.

bash

# Verify the running kernel and confirm the fix is applied
uname -r
grep -E "CONFIG_PCIE_DW|CONFIG_PCIE_DW_DEBUGFS" /boot/config-$(uname -r)

# Restrict debugfs access to root only
mount -o remount,mode=700 /sys/kernel/debug