CVE-2026-80661 (GCVE-0-2026-80661)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:49 – Updated: 2026-08-29 06:21
VLAI
Title
ufs: core: tracing: Do not dereference pointers in TP_printk()
Summary
In the Linux kernel, the following vulnerability has been resolved: ufs: core: tracing: Do not dereference pointers in TP_printk() The trace events in drivers/ufs/core/ufs_trace.h were converted to take a pointer to the hba structure as an argument for the tracepoint and then in TP_printk() the printing of the dev_name from the ring buffer was converted to using the dev dereferenced pointer from the hba saved pointer. This is not allowed as the TP_printk() is executed at the time the trace event is read from /sys/kernel/tracing/trace file. That can happen literally, seconds, minutes, hours, weeks, days, or even months later! There is no guarantee that the hba pointer will still exist by the time it is dereferenced when the "trace" file is read. Instead, save the device name from the hba pointer at the time the tracepoint is called and place it into the ring buffer event. Then the TP_printk() can read the name directly from the ring buffer and remove the possibility that it will read a freed pointer and crash the kernel. This was detected when testing the trace event code that looks for TP_printk() parameters doing illegal derferences[1] [1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 583e518e7100362e3937b583976f9470c39d1db2 , < e497fef9ad7e913f52de6f97e818f56915e96164 (git)
Affected: 583e518e7100362e3937b583976f9470c39d1db2 , < 2510434307a224078302019e52ab3c863fbe87fb (git)
Affected: 583e518e7100362e3937b583976f9470c39d1db2 , < 535fcf4b8a261fbb8cc4f91e4597343c135a90f2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufs_trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e497fef9ad7e913f52de6f97e818f56915e96164",
              "status": "affected",
              "version": "583e518e7100362e3937b583976f9470c39d1db2",
              "versionType": "git"
            },
            {
              "lessThan": "2510434307a224078302019e52ab3c863fbe87fb",
              "status": "affected",
              "version": "583e518e7100362e3937b583976f9470c39d1db2",
              "versionType": "git"
            },
            {
              "lessThan": "535fcf4b8a261fbb8cc4f91e4597343c135a90f2",
              "status": "affected",
              "version": "583e518e7100362e3937b583976f9470c39d1db2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufs_trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nufs: core: tracing: Do not dereference pointers in TP_printk()\n\nThe trace events in drivers/ufs/core/ufs_trace.h were converted to take a\npointer to the hba structure as an argument for the tracepoint and then in\nTP_printk() the printing of the dev_name from the ring buffer was\nconverted to using the dev dereferenced pointer from the hba saved\npointer.\n\nThis is not allowed as the TP_printk() is executed at the time the trace\nevent is read from /sys/kernel/tracing/trace file. That can happen\nliterally, seconds, minutes, hours, weeks, days, or even months later!\nThere is no guarantee that the hba pointer will still exist by the time it\nis dereferenced when the \"trace\" file is read.\n\nInstead, save the device name from the hba pointer at the time the\ntracepoint is called and place it into the ring buffer event. Then the\nTP_printk() can read the name directly from the ring buffer and remove the\npossibility that it will read a freed pointer and crash the kernel.\n\nThis was detected when testing the trace event code that looks for\nTP_printk() parameters doing illegal derferences[1]\n\n[1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF fires only when a local actor reads formatted UFS trace events from tracefs (/sys/kernel/tracing/trace or trace_pipe); UFS I/O merely records ring-buffer entries and provides no network, adjacent-radio, or physical-device entry to TP_printk().\nAC:L - An attacker with tracefs access controls the full sequence\u2014enable ufs trace events, generate UFS storage I/O to record hba/sdev pointers, unbind/remove the UFS host driver so those objects are freed, then read trace to deterministically hit the stale dereference without uncontrollable races.\nPR:L - Exploitation requires local tracefs read/write to enable ufs events and read formatted output; tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC (no capable()), and tracing-gid delegation on Android eng/atrace, ChromeOS, and developer kernels grants this to non-root accounts, matching prior TP_printk UAF CVEs.\nUI:N - No victim interaction is required; the attacker (or same debug account) enables UFS tracing, exercises or waits for UFS activity, triggers or observes driver teardown, and reads the trace buffer themselves to invoke the vulnerable TP_printk() formatting path.\nS:U - Impact is confined to kernel memory corruption, information disclosure, and denial of service within the host OS; this is standard local kernel privilege/availability impact with no VM escape, IOMMU bypass, or other cross-security-authority boundary crossing.\nC:H - TP_printk() dereferences freed hba-\u003edev or sdev-\u003esdev_dev via dev_name() when formatting trace output, reading stale/reused slab memory into the userspace-visible trace buffer; per kernel CNA guidance, this deferred UAF read path warrants High confidentiality impact.\nI:H - The bug is a use-after-free on kernel heap objects (ufs_hba/scsi_device) whose freed memory can be attacker-influenced through driver teardown and reallocations before trace read, enabling heap grooming and potential write/control-flow primitives beyond a read-only format string, not merely a benign crash.\nA:H - Dereferencing freed hba or scsi_device structures during trace formatting causes kernel paging faults/oopses and can panic the system; the fix explicitly states this illegal TP_printk() dereference can crash the kernel when the trace file is read after device removal."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:46.376Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e497fef9ad7e913f52de6f97e818f56915e96164"
        },
        {
          "url": "https://git.kernel.org/stable/c/2510434307a224078302019e52ab3c863fbe87fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/535fcf4b8a261fbb8cc4f91e4597343c135a90f2"
        }
      ],
      "title": "ufs: core: tracing: Do not dereference pointers in TP_printk()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80661",
    "datePublished": "2026-08-28T06:49:05.685Z",
    "dateReserved": "2026-08-26T14:34:25.781Z",
    "dateUpdated": "2026-08-29T06:21:46.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80661",
      "date": "2026-09-01",
      "epss": "0.00127",
      "percentile": "0.02643"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80661\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:51.290\",\"lastModified\":\"2026-08-29T07:16:48.547\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nufs: core: tracing: Do not dereference pointers in TP_printk()\\n\\nThe trace events in drivers/ufs/core/ufs_trace.h were converted to take a\\npointer to the hba structure as an argument for the tracepoint and then in\\nTP_printk() the printing of the dev_name from the ring buffer was\\nconverted to using the dev dereferenced pointer from the hba saved\\npointer.\\n\\nThis is not allowed as the TP_printk() is executed at the time the trace\\nevent is read from /sys/kernel/tracing/trace file. That can happen\\nliterally, seconds, minutes, hours, weeks, days, or even months later!\\nThere is no guarantee that the hba pointer will still exist by the time it\\nis dereferenced when the \\\"trace\\\" file is read.\\n\\nInstead, save the device name from the hba pointer at the time the\\ntracepoint is called and place it into the ring buffer event. Then the\\nTP_printk() can read the name directly from the ring buffer and remove the\\npossibility that it will read a freed pointer and crash the kernel.\\n\\nThis was detected when testing the trace event code that looks for\\nTP_printk() parameters doing illegal derferences[1]\\n\\n[1] https://lore.kernel.org/all/20260630184836.74d477b6@gandalf.local.home/\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/ufs/core/ufs_trace.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"583e518e7100362e3937b583976f9470c39d1db2\",\"lessThan\":\"e497fef9ad7e913f52de6f97e818f56915e96164\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"583e518e7100362e3937b583976f9470c39d1db2\",\"lessThan\":\"2510434307a224078302019e52ab3c863fbe87fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"583e518e7100362e3937b583976f9470c39d1db2\",\"lessThan\":\"535fcf4b8a261fbb8cc4f91e4597343c135a90f2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/ufs/core/ufs_trace.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2510434307a224078302019e52ab3c863fbe87fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/535fcf4b8a261fbb8cc4f91e4597343c135a90f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e497fef9ad7e913f52de6f97e818f56915e96164\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T06:55:13+00:00",
      "cve": "CVE-2026-80661",
      "id": "CVE-2026-80661",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ufs: core: tracing: Do not dereference pointers in TP_printk()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80661.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.