CVE-2026-80676 Overview
CVE-2026-80676 is a use-after-free (UAF) vulnerability in the Linux kernel's Hyper-V VMBus driver subsystem. The flaw resides in the driver probing path, where the bus match() callback is invoked from __driver_attach() without holding the device lock. This unsynchronized access to the driver_override field can result in a use-after-free condition on concurrent modification. The upstream fix replaces the custom implementation with the generic driver-core driver_override infrastructure, which handles locking internally.
Critical Impact
Concurrent access to the driver_override field without proper locking creates a race condition leading to use-after-free memory corruption in the Hyper-V VMBus code path.
Affected Products
- Linux kernel Hyper-V (hv) VMBus driver subsystem
- Linux distributions running as guests on Microsoft Hyper-V / Azure hypervisors
- Stable kernel branches receiving the referenced backports
Discovery Timeline
- 2026-08-28 - CVE-2026-80676 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80676
Vulnerability Analysis
The Linux driver core probes drivers against devices through __driver_attach(). During this process, the bus match() callback runs to determine whether a given driver should bind to a device. The Hyper-V VMBus implementation of match() reads the driver_override field to allow administrators to force a specific driver binding.
The driver core intentionally does not hold the device lock when calling match() from __driver_attach(). The VMBus code did not account for this and accessed driver_override without any additional synchronization. A concurrent writer, for example a userspace process updating the sysfs driver_override attribute, can free the string buffer while match() is still dereferencing it. The result is a use-after-free on kernel heap memory.
Root Cause
The root cause is missing synchronization around the driver_override field in the Hyper-V VMBus driver. The custom implementation did not use the driver-core helpers driver_set_override() and did not coordinate with concurrent readers in match(). Since __driver_attach() calls match() without the device lock held by design, VMBus code was responsible for its own locking and failed to provide it.
Attack Vector
Exploitation requires the ability to trigger driver probing while concurrently writing to the driver_override sysfs attribute of a VMBus device. This is typically a local, privileged operation on the guest, since sysfs driver_override writes require root. Successful racing corrupts kernel memory and can lead to denial of service or, depending on heap layout, further memory corruption primitives.
The vulnerability manifests only on systems using the Hyper-V VMBus subsystem. See the upstream fix commits for technical details and the exact code paths involved: Kernel Commit d1cb12ae, Kernel Commit 0e2f0833, Kernel Commit 2fb010ea, and Kernel Commit 331d8900.
Detection Methods for CVE-2026-80676
Indicators of Compromise
- Kernel oops or panic traces referencing vmbus_match, __driver_attach, or driver_override in the call stack.
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads inside VMBus match logic.
- Unexpected VMBus device rebind events correlated with sysfs writes to /sys/bus/vmbus/devices/*/driver_override.
Detection Strategies
- Enable KASAN on test kernels to surface UAF conditions during fuzzing of sysfs driver_override writes and hotplug events.
- Audit kernel versions across the fleet and compare against the fixed commits listed in the NVD references.
- Monitor dmesg and journald for BUG: or general protection fault entries associated with the hv_vmbus module.
Monitoring Recommendations
- Alert on writes to VMBus driver_override sysfs attributes on production Hyper-V and Azure guests, since legitimate usage is rare.
- Track kernel crash telemetry from Hyper-V guests and correlate crashes with recent driver bind or unbind operations.
- Include kernel version inventory in configuration management to identify hosts still running vulnerable builds.
How to Mitigate CVE-2026-80676
Immediate Actions Required
- Apply the stable kernel updates containing the referenced fix commits to all Linux guests running on Hyper-V or Azure.
- Restrict root and CAP_SYS_ADMIN access on affected guests to limit who can write to sysfs driver_override attributes.
- Reboot systems after patching to ensure the fixed VMBus code is loaded.
Patch Information
The fix converts the Hyper-V VMBus driver to the generic driver-core driver_override infrastructure, which manages locking internally. Reference the upstream commits: Kernel Commit d1cb12ae, Kernel Commit 0e2f0833, Kernel Commit 2fb010ea, and Kernel Commit 331d8900. Distribution vendors ship these fixes through their standard stable kernel update channels.
Workarounds
- Avoid writing to VMBus driver_override sysfs attributes on unpatched kernels; leave driver binding to the default matching logic.
- Reduce the attack surface by minimizing the number of privileged users and processes on Hyper-V guests until patches are deployed.
- Deploy mandatory access control policies, such as SELinux or AppArmor, that restrict write access to /sys/bus/vmbus/devices/*/driver_override.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.