CVE-2026-80660 Overview
CVE-2026-80660 is a Linux kernel vulnerability in the hwmon On-Chip Controller (OCC) driver. The flaw is a circular locking dependency between occ->lock and the sysfs callback drain path. occ_active(false) and occ_shutdown() unregister sysfs-backed devices while holding occ->lock. hwmon_device_unregister() and sysfs_remove_group() wait for active sysfs callbacks to drain, and those callbacks re-enter the OCC update path and try to acquire occ->lock. Static analysis identified the ordering conflict, and lockdep confirmed the circular dependency at runtime. The resolved patch serializes registration and removal with a separate hwmon_lock and drops occ->lock before calling hwmon_device_unregister().
Critical Impact
A local trigger of the OCC teardown path concurrent with sysfs reads can deadlock the kernel thread, causing a denial of service on affected IBM POWER hwmon-enabled systems.
Affected Products
- Linux kernel hwmon OCC driver (drivers/hwmon/occ)
- Stable branches receiving backports referenced by commits 2092952f, 2a4c80ff, 7ee43ec8, e3140873, e7fd81e9, and f0aad157
- Systems using IBM POWER On-Chip Controller telemetry via hwmon sysfs
Discovery Timeline
- 2026-08-28 - CVE-2026-80660 published to the National Vulnerability Database (NVD)
- 2026-08-28 - Last updated in the NVD database
Technical Details for CVE-2026-80660
Vulnerability Analysis
The defect is a race condition classified as a deadlock caused by inverted lock ordering [CWE-833]. Two code paths acquire the same two synchronization primitives in opposite orders.
The teardown path takes occ->lock first, then indirectly waits on the sysfs lock through hwmon_device_unregister() and sysfs_remove_group(). Concurrently, a sysfs read handler such as occ_show_temp_1() holds the sysfs active reference and calls occ_update_response(), which then attempts to acquire occ->lock.
When both paths execute concurrently, the kernel enters a circular wait. Lockdep reports the condition as WARNING: possible circular locking dependency detected with sysfs_lock blocked at hwmon_device_unregister and &test_occ.lock blocked at occ_shutdown.
Root Cause
The OCC driver mixed two distinct synchronization responsibilities under a single mutex. The occ->lock mutex guarded both hardware update state and hwmon device lifecycle operations. Because sysfs enforces its own drain semantics on attribute removal, any lifecycle operation that removes attributes must not hold a lock that sysfs callbacks re-enter.
Attack Vector
Exploitation requires local access to a system running the vulnerable OCC driver. A user with read access to OCC hwmon sysfs attributes can hold the sysfs active reference by issuing reads against files such as those handled by occ_show_temp_1(). If a driver unbind or shutdown races with these reads, the kernel deadlocks. The vector is local privilege denial of service, not code execution. No verified proof-of-concept code is published beyond the lockdep trace in the commit message. See the upstream fixes at Kernel Git Commit e7fd81e9 and Kernel Git Commit 2092952f.
Detection Methods for CVE-2026-80660
Indicators of Compromise
- Kernel log entries containing WARNING: possible circular locking dependency detected referencing hwmon_device_unregister and the OCC mutex.
- Hung task warnings mentioning occ_shutdown, occ_update_response, or occ_show_temp_1 in dmesg.
- Stalled processes in uninterruptible sleep (state D) blocked on OCC sysfs reads during driver unbind.
Detection Strategies
- Enable CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP on test kernels to surface the circular dependency during QA.
- Collect and centralize kernel ring buffer output from POWER hosts and alert on lockdep warnings tied to hwmon or occ.
- Correlate driver bind and unbind events on /sys/bus/platform/drivers/occ* with sysfs read activity on OCC attributes.
Monitoring Recommendations
- Forward /var/log/kern.log or the journald kernel stream to a centralized log platform and match on occ_shutdown, hwmon_device_unregister, and sysfs_lock.
- Monitor system availability metrics for POWER servers exposing OCC telemetry, since a deadlock manifests as loss of hwmon data collection.
- Track kernel package versions to identify hosts still running pre-patch builds of the OCC driver.
How to Mitigate CVE-2026-80660
Immediate Actions Required
- Apply the upstream OCC hwmon locking fix from the stable tree to affected kernels.
- Update to a Linux distribution kernel release that incorporates the referenced stable commits.
- Restrict local access to OCC hwmon sysfs attributes to trusted management users until the patch is deployed.
Patch Information
The fix serializes hwmon registration and removal with a dedicated hwmon_lock, detaches occ->hwmon and updates occ->active under occ->lock, then drops occ->lock before calling hwmon_device_unregister(). The driver sysfs group is removed before taking occ->lock in occ_shutdown(). OCC update callbacks return -ENODEV after deactivation. Backports are available at Kernel Git Commit 2a4c80ff, Kernel Git Commit 7ee43ec8, Kernel Git Commit e31408734, and Kernel Git Commit f0aad157.
Workarounds
- Unload the OCC driver on systems that do not require OCC telemetry using modprobe -r occ_hwmon or the platform equivalent.
- Avoid concurrent driver unbind operations while userspace agents are actively polling OCC hwmon attributes.
- Reduce sysfs polling frequency of OCC attributes to shrink the race window on unpatched hosts.
# Verify OCC driver presence and remove if telemetry is not required
lsmod | grep -i occ
sudo modprobe -r occ_hwmon || true
# Confirm running kernel includes the fix by checking the changelog
uname -r
rpm -q --changelog kernel | grep -i "hwmon.*occ" | head
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
