CVE-2026-80688: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80688 Overview

CVE-2026-80688 is a Linux kernel vulnerability in the RISC-V architecture code. The function vec_check_unaligned_access_speed_all_cpus was marked with __init, causing its code to reside in the .init.text section. Because the function runs inside a kthread, execution can persist past boot completion. When free_initmem() unmaps the .init.text region, any subsequent instruction fetch triggers an instruction page fault and a kernel Oops. The fix drops the __init annotation so the function remains resident in memory after boot.

Critical Impact
Late execution of the kthread after free_initmem() produces a kernel paging request failure on RISC-V systems, resulting in a denial-of-service condition through kernel panic.

Affected Products

Linux kernel on RISC-V architecture
Kernels containing vec_check_unaligned_access_speed_all_cpus in arch/riscv/kernel
Stable branches referenced by kernel commits 01bd01b, 25f228e, and f51fed6

Discovery Timeline

2026-08-28 - CVE-2026-80688 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80688

Vulnerability Analysis

The issue is a use-after-free of kernel .init.text memory on RISC-V. The function vec_check_unaligned_access_speed_all_cpus performs Supervisor Binary Interface (SBI) calls to probe unaligned vector access speed on each CPU. The function is dispatched inside a kthread, and there is no guarantee that the kthread completes before the kernel finishes booting.

Once the kernel invokes free_initmem(), the .init.text section is unmapped and returned to the page allocator. If the kthread is still runnable at that point, the CPU attempts to fetch instructions from a virtual address that no longer has a valid mapping. This produces an instruction page fault with cause code 0xc, as visible in the reported Oops with badaddr: ffffffff80a04ef8.

The corrective patch drops the __init attribute from the function signature so the code stays mapped for the lifetime of the kernel. The kthread can then complete safely regardless of scheduling delays introduced by slow SBI implementations or added debug output.

Root Cause

The root cause is an incorrect section annotation. Marking vec_check_unaligned_access_speed_all_cpus with __init placed executable code into a section slated for release during late boot. Kernel code invoked from a kthread must remain resident, but the annotation contradicted that lifetime requirement.

Attack Vector

This defect is a reliability and stability issue rather than a remotely reachable flaw. Triggering requires slow SBI unaligned-access probing on a RISC-V platform, extending the kthread runtime past free_initmem(). Local conditions such as debug builds, verbose SBI firmware, or slow platforms increase reproducibility. The referenced kernel commits describe the fix in prose; no exploit code exists.

Detection Methods for CVE-2026-80688

Indicators of Compromise

Kernel Oops entries referencing vec_check_unaligned_access_speed_all_cpus in the fault program counter.
Log messages reporting Unable to handle kernel paging request at virtual address within the .init.text range on RISC-V.
Boot-time kthread named vec_check_unali surviving past free_initmem().

Detection Strategies

Parse kernel logs and dmesg output for RISC-V paging faults tied to the affected symbol.
Track kernel version and architecture inventory to identify RISC-V hosts running pre-patch builds.
Correlate boot-time crashes with the presence of the __init-annotated symbol in the running vmlinux.

Monitoring Recommendations

Forward RISC-V host serial console and kmsg output to a central log store for kernel panic review.
Alert on repeated kernel Oops events during boot, especially those citing .init.text addresses.
Track upstream stable branch merges of commits 01bd01b, 25f228e, and f51fed6 in build pipelines.

How to Mitigate CVE-2026-80688

Immediate Actions Required

Apply the upstream kernel patches that remove __init from vec_check_unaligned_access_speed_all_cpus.
Rebuild RISC-V kernel images and redeploy to affected hosts and development boards.
Verify that SBI firmware on affected platforms operates at expected performance to reduce kthread latency.

Patch Information

The fix ships in the kernel commits Kernel Git Commit 01bd01b, Kernel Git Commit 25f228e, and Kernel Git Commit f51fed6. Each commit drops the __init annotation so the affected function remains mapped after free_initmem() completes.

Workarounds

Disable RISC-V vector unaligned access probing in kernel configuration where the option is available.
Avoid deploying pre-patch RISC-V kernels on platforms with known slow SBI probing paths.
Remove debug prints or instrumentation in SBI that materially extend probe duration until the patch is applied.

bash

# Verify the running kernel includes the fix on a RISC-V host
uname -r
zgrep -i 'vec_check_unaligned_access_speed_all_cpus' /proc/kallsyms
dmesg | grep -i 'Unable to handle kernel paging request'