CVE-2026-80622: Linux Kernel tlclk Use-After-Free Vulnerability

CVE-2026-80622 Overview

CVE-2026-80622 is a use-after-free vulnerability in the Linux kernel tlclk character driver. The flaw resides in the tlclk_cleanup() function, which frees the alarm_events memory before ensuring that blocked processes in the waitqueue are awakened and that the switchover_timer has completed. Additionally, the driver's file_operations structure omits the .owner field, allowing the module to be unloaded while user-space processes still hold references to the device. A local, low-privileged attacker who can interact with the device can trigger race conditions leading to memory corruption.

Critical Impact
Local attackers can trigger use-after-free conditions in the Linux kernel tlclk driver, potentially resulting in kernel memory corruption, privilege escalation, or denial of service.

Affected Products

Linux kernel tlclk character driver (drivers/char/tlclk.c)
Multiple stable Linux kernel branches receiving backported fixes
Systems where the tlclk module is loaded and accessible to local users

Discovery Timeline

2026-08-28 - CVE-2026-80622 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80622

Vulnerability Analysis

The tlclk driver exposes a character device that user-space processes can open, read, and block on via a waitqueue. During module teardown, tlclk_cleanup() releases resources in an unsafe order. The alarm_events buffer is freed before the driver wakes blocked readers or cancels the pending switchover_timer. Any thread that resumes from the waitqueue, or any timer callback that fires after alarm_events is released, dereferences freed kernel memory.

The absence of .owner = THIS_MODULE in the file_operations structure compounds the issue. Without the owner reference, the kernel does not increment the module's reference count when user-space opens the device. An administrator can rmmod the module while file descriptors remain open, unmapping the driver's code and data while active syscalls still execute inside it.

Root Cause

The root cause is a combination of missing module reference counting and improper cleanup ordering. The freed object alarm_events remains reachable through the waitqueue and the still-armed switchover_timer, creating a classic use-after-free window during module unload.

Attack Vector

Exploitation requires local access with permission to open the tlclk device node. An attacker opens the device and issues a blocking read to park a thread in the waitqueue. A concurrent module unload triggers tlclk_cleanup(), which frees alarm_events. When the blocked thread wakes or the switchover_timer fires, kernel code operates on freed memory. Skilled attackers can shape adjacent heap allocations to convert the use-after-free into arbitrary kernel memory writes and local privilege escalation.

No public proof-of-concept is available. Technical details on the fix are documented in the Kernel Git Commit 09d8d2a and the Kernel Git Commit 764723b.

Detection Methods for CVE-2026-80622

Indicators of Compromise

Kernel oops or panic messages referencing tlclk_cleanup, alarm_events, or switchover_timer in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free reads or writes inside the tlclk module
Unexpected rmmod tlclk events while the device node /dev/tlclk has active file descriptors

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and staging kernels to surface use-after-free access patterns in the tlclk module.
Audit loaded kernel modules against a baseline and alert on unexpected tlclk loads on hosts that do not require Telecom Clock hardware.
Correlate init_module and delete_module syscall telemetry with open file descriptors on /dev/tlclk.

Monitoring Recommendations

Forward kernel ring buffer and audit logs to a centralized SIEM and alert on kernel oops signatures referencing tlclk.
Monitor privileged operations that load or unload kernel modules and require change-control tickets for module changes on production hosts.
Track process access to /dev/tlclk and flag non-standard consumers.

How to Mitigate CVE-2026-80622

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and reboot affected systems.
On systems that do not require Telecom Clock hardware, blacklist the tlclk module to eliminate the attack surface.
Restrict permissions on /dev/tlclk so that only trusted service accounts can open the device.
Restrict CAP_SYS_MODULE to minimize the risk of unauthorized module unload operations.

Patch Information

The fix sets .owner = THIS_MODULE in tlclk_fops to defer module unloading while the device is in use. It also updates tlclk_cleanup() to call wake_up_all() on blocked readers, release hardware I/O regions, and invoke timer_delete_sync() on switchover_timer before freeing alarm_events. Backports are available across stable branches, including Kernel Git Commit 166dd1d, Kernel Git Commit 3d5e4cc, Kernel Git Commit 4222344, Kernel Git Commit 9690229, Kernel Git Commit bbf003b, and Kernel Git Commit c3f0cd7.

Workarounds

Blacklist the tlclk module via /etc/modprobe.d/blacklist-tlclk.conf on hosts that do not use the driver.
Remove or tighten permissions on /dev/tlclk to prevent unprivileged access.
Avoid unloading the tlclk module on production systems until patched kernels are deployed.

bash

# Configuration example: prevent tlclk from loading
echo "blacklist tlclk" | sudo tee /etc/modprobe.d/blacklist-tlclk.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep tlclk