CVE-2026-80643: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80643 Overview

CVE-2026-80643 is a Linux kernel vulnerability in the igen6_edac driver, which provides Error Detection And Correction (EDAC) support for Intel client SoC integrated memory controllers. The driver fails to supply a release() function for its memory controller devices. When the module is unloaded, the kernel emits a warning from device_release() in drivers/base/core.c and produces a call trace originating in igen6_unregister_mcis(). The fix introduces empty release() functions for the affected devices, aligning the driver with the kernel object (kobject) lifecycle contract documented in Documentation/core-api/kobject.rst.

Critical Impact
Unloading the igen6_edac driver on affected kernels triggers a kernel warning and call trace, indicating a broken device teardown path in the EDAC subsystem.

Affected Products

Linux kernel builds that include the igen6_edac EDAC driver
Systems using Intel client SoC integrated memory controllers monitored by igen6_edac
Distributions shipping vulnerable kernel versions prior to commits 9a84ced0243, a341302c51, and ab1f9d466c

Discovery Timeline

2026-08-28 - CVE-2026-80643 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80643

Vulnerability Analysis

The igen6_edac driver registers memory controller (mc) devices with the Linux device model but does not attach a release() callback. The Linux driver core requires every struct device to provide a release() function so that reference counting through kobject_put() can free the device safely. When the driver is removed with rmmod, igen6_unregister_mcis() calls put_device(), which drops the final kobject reference and invokes device_release(). Because no release() handler is registered, the kernel logs a WARNING at drivers/base/core.c:2567 and prints the call trace shown in the advisory. This constitutes a driver-lifecycle defect [CWE-noinfo] rather than a memory-safety flaw exploitable from userland.

Root Cause

The root cause is a missing device teardown callback. The memory controller devices allocated by igen6_edac have no dev.release method assigned before device_register() is called indirectly through the EDAC core. Kernel policy treats this as a broken driver and emits a warning at unload time to prevent silent leaks or use-after-free during device destruction.

Attack Vector

Triggering the warning requires local privileged access to unload the module (CAP_SYS_MODULE). The condition is reachable only by administrators performing module removal or by init/udev workflows that toggle EDAC support. There is no remote or unprivileged vector, and no evidence of exploitation. The observed symptom is a WARN_ON splat with the following call chain: device_release → kobject_put → put_device → igen6_unregister_mcis → igen6_remove.

See the upstream fixes for technical details: Kernel Git Commit 9a84ced0243, Kernel Git Commit a341302c51, and Kernel Git Commit ab1f9d466c.

Detection Methods for CVE-2026-80643

Indicators of Compromise

Kernel log entries containing the string Device '(null)' does not have a release() function.
WARNING backtraces referencing device_release+0x84/0x90 originating from igen6_unregister_mcis or igen6_remove in the igen6_edac module.
dmesg output showing repeated warnings after rmmod igen6_edac or automated module reload events.

Detection Strategies

Inventory running kernels and compare against the fixed commits 9a84ced0243, a341302c51, and ab1f9d466c to identify unpatched hosts.
Parse journalctl -k and /var/log/messages for the specific WARN string and function names listed above.
Correlate module unload events (kmod audit records) with kernel WARN events to attribute the trigger.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on new WARN traces from EDAC drivers.
Monitor auditd for SYSCALL records of delete_module targeting igen6_edac on production hosts.
Track kernel package versions across the fleet and flag hosts still running pre-fix builds.

How to Mitigate CVE-2026-80643

Immediate Actions Required

Apply the vendor-provided kernel update that includes the upstream fixes referenced in the advisory.
Avoid manually unloading igen6_edac on unpatched systems to prevent the WARN and any downstream device-lifecycle issues.
Restrict CAP_SYS_MODULE and module unload operations to trusted administrators.

Patch Information

The fix adds empty release() callbacks for the memory controller devices in igen6_edac, satisfying the kernel device model contract. The change is captured in the upstream commits 9a84ced0243, a341302c51, and ab1f9d466c. Consume the fix through your distribution's kernel package once backported, or by rebuilding a stable kernel that includes these commits.

Workarounds

Blacklist the igen6_edac module on affected hosts if EDAC reporting for Intel client SoCs is not required.
Leave the module loaded for the lifetime of the system to avoid triggering the teardown path until a patched kernel is deployed.
Suppress alerting noise by filtering the specific WARN signature in log pipelines while patching is scheduled.

bash

# Blacklist the driver until a patched kernel is installed
echo 'blacklist igen6_edac' | sudo tee /etc/modprobe.d/blacklist-igen6_edac.conf
sudo update-initramfs -u   # Debian/Ubuntu
# or
sudo dracut -f             # RHEL/Fedora/SUSE