CVE-2026-80661: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80661 Overview

CVE-2026-80661 is a Linux kernel vulnerability in the Universal Flash Storage (UFS) core tracing subsystem. The flaw resides in drivers/ufs/core/ufs_trace.h, where trace events were converted to accept a pointer to the hba structure and dereference it inside TP_printk(). Because TP_printk() executes when a user reads /sys/kernel/tracing/trace, the dereference can occur seconds to months after the tracepoint fires. If the hba pointer has been freed by that time, reading the trace file dereferences stale memory and crashes the kernel.

Critical Impact
A local user with access to the kernel tracing interface can trigger a use-after-free by reading trace output, resulting in kernel memory corruption or denial of service.

Affected Products

Linux kernel builds shipping the UFS core tracing code in drivers/ufs/core/ufs_trace.h
Distributions and downstream kernels that inherit the affected UFS tracepoint changes
Systems exposing /sys/kernel/tracing/trace to privileged local users

Discovery Timeline

2026-08-28 - CVE-2026-80661 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80661

Vulnerability Analysis

The Linux kernel tracing framework separates event recording from event formatting. When a tracepoint fires, its TP_fast_assign() block writes fields into the ring buffer. The TP_printk() block runs later, when userspace reads the trace file. Any pointer captured by the tracepoint must therefore remain valid for the lifetime of the ring buffer entry, not merely for the duration of the tracepoint call.

The UFS trace events violated this contract. They stored a raw hba host-controller pointer and later dereferenced hba->dev inside TP_printk() to retrieve the device name. Between the tracepoint firing and the trace file being read, the hba structure can be released during driver teardown, module unload, or device removal. Reading /sys/kernel/tracing/trace after that release dereferences freed memory in kernel context.

Root Cause

The root cause is an unsafe pointer dereference in TP_printk() — a classic Use-After-Free pattern applied to the tracing ring buffer. The fix records the device name string into the ring buffer event at trace time via TP_fast_assign(), and TP_printk() then reads the copied string directly from the buffer instead of following the hba pointer.

Attack Vector

Exploitation requires local access with permission to read the kernel tracing interface, typically restricted to root or users with CAP_SYS_ADMIN. An attacker enables the affected UFS tracepoints, triggers UFS activity, forces the hba structure to be freed (for example through device removal or module unload flows), and then reads /sys/kernel/tracing/trace. The stale pointer dereference destabilizes the kernel and can be leveraged for denial of service or further memory corruption depending on allocator state.

No verified public proof-of-concept is available. See the upstream fix commits for technical details: Kernel commit 2510434307a2, Kernel commit 535fcf4b8a26, and Kernel commit e497fef9ad7e.

Detection Methods for CVE-2026-80661

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ufshcd, ufs_trace, or TP_printk in dmesg or /var/log/kern.log
Reads of /sys/kernel/tracing/trace correlated with UFS device removal, hotplug, or module unload events
Enablement of UFS tracepoints under /sys/kernel/tracing/events/ufs/ on systems that do not normally use kernel tracing

Detection Strategies

Audit the running kernel version and confirm whether the three upstream fix commits are backported
Monitor auditd for writes to files under /sys/kernel/tracing/ and reads of the trace file by non-standard processes
Alert on kernel crash signatures involving the UFS subsystem and tracepoint stack frames

Monitoring Recommendations

Forward kernel logs and audit events to a centralized logging or SIEM platform for correlation of tracing activity with device removal events
Track loaded kernel modules and driver hotplug events on UFS-equipped hosts, including mobile-class and embedded Linux systems
Baseline which accounts legitimately require access to /sys/kernel/tracing/ and alert on deviations

How to Mitigate CVE-2026-80661

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the three git.kernel.org commits and rebuild or upgrade affected kernels
Restrict access to /sys/kernel/tracing/ to trusted administrators only and ensure tracefs is not world-readable
Inventory systems using UFS storage (common in mobile, automotive, and embedded Linux deployments) and prioritize patching

Patch Information

The fix moves device-name capture into TP_fast_assign() so the string is copied into the ring buffer at trace time, eliminating the deferred pointer dereference. The corrective changes are available in the stable kernel commits 2510434307a2, 535fcf4b8a26, and e497fef9ad7e. Distribution vendors will ship these fixes in their next stable kernel updates.

Workarounds

Disable the affected UFS tracepoints under /sys/kernel/tracing/events/ufs/ until a patched kernel is deployed
Remove read permissions on /sys/kernel/tracing/trace for non-administrative accounts
Where feasible, mount tracefs with restrictive permissions or disable CONFIG_TRACING-dependent debugging on production hosts

bash

# Disable UFS tracepoints as a temporary mitigation
echo 0 > /sys/kernel/tracing/events/ufs/enable

# Restrict access to the tracing interface
chmod 700 /sys/kernel/tracing