CVE-2026-80660 - Vulnerability Details

- hwmon: (occ) unregister sysfs devices outside occ lock

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (occ) unregister sysfs devices outside occ lock

occ_active(false) and occ_shutdown() unregister sysfs-backed devices while
occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can
wait for active sysfs callbacks to drain, and those callbacks can enter the
OCC update path and try to take occ->lock again. That gives the unregister
paths the lock ordering occ->lock -> sysfs callback drain, while a callback
has the opposite edge sysfs callback -> occ->lock.

This issue was found by our static analysis tool and then manually
reviewed against the current tree.

The grounded PoC kept the real unregister and callback carrier:

occ_shutdown()
hwmon_device_unregister()
occ_show_temp_1()
occ_update_response()

Lockdep reported the circular dependency with occ_shutdown() already
holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs
side:

WARNING: possible circular locking dependency detected
... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv]
... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv]
occ_update_response.isra.0+0xb/0x20 [vuln_msv]
occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv]
*** DEADLOCK ***

Serialize hwmon registration and removal with a separate hwmon_lock.
Under that lock, detach occ->hwmon and update occ->active while occ->lock
is held so concurrent OCC state changes still see a stable state, then
drop occ->lock before calling hwmon_device_unregister(). Remove the
driver sysfs group before taking occ->lock in occ_shutdown(), so draining
the driver attributes cannot wait while the OCC mutex is held. Also make
OCC update callbacks return -ENODEV after deactivation, so callbacks that
already passed sysfs active protection do not poll the hardware after
teardown has detached the hwmon device.

Published: 2026-08-28

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A lock ordering bug in the Linux kernel’s hardware monitoring (hwmon) subsystem causes a deadlock when sysfs devices are unregistered while the OCC (On‑Chip Controller) lock is held. The flaw arises because the unregister path holds the OCC mutex and then waits for active sysfs callbacks to drain, which in turn may request the OCC lock again, creating a circular dependency that leads to a kernel hang.

Affected Systems

The vulnerability affects the Linux kernel, all kernel versions maintained by the developers that implement the hwmon subsystem prior to the fix commit. The fix was applied in the mainline kernel, so all previous kernel versions are potentially vulnerable.

Risk and Exploitability

The CVSS score is 5.5, the EPSS score is less than 1%, and the issue is not listed in CISA’s KEV catalog. No public exploit has been reported. The bug can be triggered by operations that invoke occ_shutdown or hwmon device removal, which likely require privileged access. An attacker with such access could induce a deadlock and disrupt service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`849b0156d9960da628a06756bb920d9571c15e66`	affected	< 2a4c80ff3571498ec6a916273304b6650026b1b0
`849b0156d9960da628a06756bb920d9571c15e66`	affected	< e7fd81e9fb1fe476d2131fec66c1138457810ed4
`849b0156d9960da628a06756bb920d9571c15e66`	affected	< 2092952f22a7da98e76e84139ae202b1fc7ba899
`849b0156d9960da628a06756bb920d9571c15e66`	affected	< f0aad157576da199c146c1bb266442befa7912ca
`849b0156d9960da628a06756bb920d9571c15e66`	affected	< 7ee43ec8e6774774abbe9dc3027225e01bc964a5
`849b0156d9960da628a06756bb920d9571c15e66`	affected	< e31408734332b8cc611342cdaaab6ba492180156
`bc8a32726774286325b0cb0daab55b682cafc1ef`	affected	—
`5.15.216`	affected	< 5.16

Linux

affected

Version	Status	Constraints
`5.19`	affected	—
`0`	unaffected	< 5.19
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[849b0156d9960da628a06756bb920d9571c15e66,2a4c80ff3571498ec6a916273304b6650026b1b0)`	affected	code_commit	—
`[849b0156d9960da628a06756bb920d9571c15e66,e7fd81e9fb1fe476d2131fec66c1138457810ed4)`	affected	code_commit	—
`[849b0156d9960da628a06756bb920d9571c15e66,2092952f22a7da98e76e84139ae202b1fc7ba899)`	affected	code_commit	—
`[849b0156d9960da628a06756bb920d9571c15e66,f0aad157576da199c146c1bb266442befa7912ca)`	affected	code_commit	—
`[849b0156d9960da628a06756bb920d9571c15e66,7ee43ec8e6774774abbe9dc3027225e01bc964a5)`	affected	code_commit	—
`[849b0156d9960da628a06756bb920d9571c15e66,e31408734332b8cc611342cdaaab6ba492180156)`	affected	code_commit	—
`bc8a32726774286325b0cb0daab55b682cafc1ef`	affected	code_commit	—
`[5.15.216,5.16)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.19`	affected	semver	—
`[0,5.19)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2,7.3.0)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to a Linux kernel version that implements the fix, ensuring that hwmon registration and removal are protected by a dedicated hwmon_lock and that the OCC mutex is released before calling hwmon_device_unregister()
If an immediate kernel upgrade is not feasible, disable or limit the use of OCC‑related hwmon devices in the system configuration to avoid reaching the code path that can trigger the deadlock
Restrict privileged processes that can invoke occ_shutdown or hwmon device removal to prevent accidental or malicious execution of the faulty code

Generated by OpenCVE AI on September 2, 2026 at 05:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2092952f22a7da98e76e84139ae202b1fc7ba899
https://git.kernel.org/stable/c/2a4c80ff3571498ec6a916273304b6650026b1b0
https://git.kernel.org/stable/c/7ee43ec8e6774774abbe9dc3027225e01bc964a5
https://git.kernel.org/stable/c/e31408734332b8cc611342cdaaab6ba492180156
https://git.kernel.org/stable/c/e7fd81e9fb1fe476d2131fec66c1138457810ed4
https://git.kernel.org/stable/c/f0aad157576da199c146c1bb266442befa7912ca
https://lore.kernel.org/linux-cve-announce/2026082845-CVE-2026-80660-d193@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80660
https://www.cve.org/CVERecord?id=CVE-2026-80660

History

Tue, 01 Sep 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-322

Tue, 01 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://lore.kernel.org/linux-cve-announce/2026082845-CVE-2026-80660-d193@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80660 https://www.cve.org/CVERecord?id=CVE-2026-80660
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 28 Aug 2026 11:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-322

Fri, 28 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hwmon: (occ) unregister sysfs devices outside occ lock occ_active(false) and occ_shutdown() unregister sysfs-backed devices while occ->lock is held. hwmon_device_unregister() and sysfs_remove_group() can wait for active sysfs callbacks to drain, and those callbacks can enter the OCC update path and try to take occ->lock again. That gives the unregister paths the lock ordering occ->lock -> sysfs callback drain, while a callback has the opposite edge sysfs callback -> occ->lock. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the real unregister and callback carrier: occ_shutdown() hwmon_device_unregister() occ_show_temp_1() occ_update_response() Lockdep reported the circular dependency with occ_shutdown() already holding the OCC mutex and hwmon_device_unregister() waiting on the sysfs side: WARNING: possible circular locking dependency detected ... (sysfs_lock) ... at: hwmon_device_unregister+0x12/0x30 [vuln_msv] ... (&test_occ.lock) ... at: occ_shutdown.constprop.0+0xe/0x40 [vuln_msv] occ_update_response.isra.0+0xb/0x20 [vuln_msv] occ_show_temp_1.constprop.0.isra.0+0x23/0x40 [vuln_msv] * DEADLOCK * Serialize hwmon registration and removal with a separate hwmon_lock. Under that lock, detach occ->hwmon and update occ->active while occ->lock is held so concurrent OCC state changes still see a stable state, then drop occ->lock before calling hwmon_device_unregister(). Remove the driver sysfs group before taking occ->lock in occ_shutdown(), so draining the driver attributes cannot wait while the OCC mutex is held. Also make OCC update callbacks return -ENODEV after deactivation, so callbacks that already passed sysfs active protection do not poll the hardware after teardown has detached the hwmon device.
Title		hwmon: (occ) unregister sysfs devices outside occ lock
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2092952f22a7da98e76e84139ae202b1fc7ba899 https://git.kernel.org/stable/c/2a4c80ff3571498ec6a916273304b6650026b1b0 https://git.kernel.org/stable/c/7ee43ec8e6774774abbe9dc3027225e01bc964a5 https://git.kernel.org/stable/c/e31408734332b8cc611342cdaaab6ba492180156 https://git.kernel.org/stable/c/e7fd81e9fb1fe476d2131fec66c1138457810ed4 https://git.kernel.org/stable/c/f0aad157576da199c146c1bb266442befa7912ca

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-28T06:49:04.992Z

Updated: 2026-08-28T06:49:04.992Z

Reserved: 2026-08-26T14:34:25.780Z

Link: CVE-2026-80660

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-28T08:16:51.160

Modified: 2026-08-28T08:16:51.160

Link: CVE-2026-80660

Redhat

Severity : Moderate

Publid Date: 2026-08-28T00:00:00Z

Links: CVE-2026-80660 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-02T05:30:08Z

Weaknesses

CWE-833
Deadlock

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object