CVE-2026-80732 - Vulnerability Details

- ata: pata_sl82c105: fix bridge revision use-after-free

Description

In the Linux kernel, the following vulnerability has been resolved:

ata: pata_sl82c105: fix bridge revision use-after-free

pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b
("PCI: Change all drivers to use pci_device->revision") replaced a
configuration-space read with direct access to the cached revision field,
but left that access after pci_dev_put(). The bridge may therefore be freed
before its revision is read.

Read the revision before dropping the reference.

Published: 2026-09-03

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use‑after‑free flaw in the Linux kernel’s ATA driver for the SL82C105 bridge device. After pci_dev_put() released the PCI device, the driver attempted to read the cached PCI revision field, corrupting kernel memory. Exploitation could enable an attacker to alter kernel data or trigger a denial of service by causing a kernel panic.

Affected Systems

Any Linux system that incorporates the ATA SL82C105 driver and includes the buggy code path is affected. The vulnerability existed until the fix was merged in commit 44c10138fd4b; the specific kernel versions are not enumerated in the advisory, so all kernels containing the unpatched path are at risk.

Risk and Exploitability

No public exploit has been reported, and the issue is not listed in CISA’s KEV. The EPSS score is unavailable, so the likelihood remains uncertain. The patch in commit 44c10138fd4b fully eliminates this risk once applied.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`44c10138fd4bbc4b6d6bff0873c24902f2a9da65`	affected	< 1268ca9418e2217f2b60705cf4a280b689b26678
`44c10138fd4bbc4b6d6bff0873c24902f2a9da65`	affected	< a626dfca96041842053cf2d1efceb436c4cd8dcf
`44c10138fd4bbc4b6d6bff0873c24902f2a9da65`	affected	< 5ef87b1b4656d675440ceab32a56e69ad958d3a1
`44c10138fd4bbc4b6d6bff0873c24902f2a9da65`	affected	< fa0dca89b4fb0909ffda7b9ab6051af33270f95e
`44c10138fd4bbc4b6d6bff0873c24902f2a9da65`	affected	< dc711fb137b33c12e6ca22b6a9c9b9f21d49e4de
`44c10138fd4bbc4b6d6bff0873c24902f2a9da65`	affected	< a837deeaa37cc3f0e8c4e5c096787047f272c956
`44c10138fd4bbc4b6d6bff0873c24902f2a9da65`	affected	< 56fd78c8c820f527f8003e379ab71004b2e79a44
`44c10138fd4bbc4b6d6bff0873c24902f2a9da65`	affected	< 7700a31039cdc6715cb6cce7e7a664ee4e945f67

Linux

affected

Version	Status	Constraints
`2.6.23`	affected	—
`0`	unaffected	< 2.6.23
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[44c10138fd4bbc4b6d6bff0873c24902f2a9da65,1268ca9418e2217f2b60705cf4a280b689b26678)`	affected	code_commit	—
`[44c10138fd4bbc4b6d6bff0873c24902f2a9da65,a626dfca96041842053cf2d1efceb436c4cd8dcf)`	affected	code_commit	—
`[44c10138fd4bbc4b6d6bff0873c24902f2a9da65,5ef87b1b4656d675440ceab32a56e69ad958d3a1)`	affected	code_commit	—
`[44c10138fd4bbc4b6d6bff0873c24902f2a9da65,fa0dca89b4fb0909ffda7b9ab6051af33270f95e)`	affected	code_commit	—
`[44c10138fd4bbc4b6d6bff0873c24902f2a9da65,dc711fb137b33c12e6ca22b6a9c9b9f21d49e4de)`	affected	code_commit	—
`[44c10138fd4bbc4b6d6bff0873c24902f2a9da65,a837deeaa37cc3f0e8c4e5c096787047f272c956)`	affected	code_commit	—
`[44c10138fd4bbc4b6d6bff0873c24902f2a9da65,56fd78c8c820f527f8003e379ab71004b2e79a44)`	affected	code_commit	—
`[44c10138fd4bbc4b6d6bff0873c24902f2a9da65,7700a31039cdc6715cb6cce7e7a664ee4e945f67)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.23`	affected	semver	—
`[0,2.6.23)`	unaffected	generic	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes commit 44c10138fd4b
For custom kernel builds, incorporate the fixed source and rebuild affected modules
Restart all affected systems to ensure the patched kernel and driver load

Generated by OpenCVE AI on September 3, 2026 at 13:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1268ca9418e2217f2b60705cf4a280b689b26678
https://git.kernel.org/stable/c/56fd78c8c820f527f8003e379ab71004b2e79a44
https://git.kernel.org/stable/c/5ef87b1b4656d675440ceab32a56e69ad958d3a1
https://git.kernel.org/stable/c/7700a31039cdc6715cb6cce7e7a664ee4e945f67
https://git.kernel.org/stable/c/a626dfca96041842053cf2d1efceb436c4cd8dcf
https://git.kernel.org/stable/c/a837deeaa37cc3f0e8c4e5c096787047f272c956
https://git.kernel.org/stable/c/dc711fb137b33c12e6ca22b6a9c9b9f21d49e4de
https://git.kernel.org/stable/c/fa0dca89b4fb0909ffda7b9ab6051af33270f95e

History

Fri, 04 Sep 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 03 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 03 Sep 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore be freed before its revision is read. Read the revision before dropping the reference.
Title		ata: pata_sl82c105: fix bridge revision use-after-free
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1268ca9418e2217f2b60705cf4a280b689b26678 https://git.kernel.org/stable/c/56fd78c8c820f527f8003e379ab71004b2e79a44 https://git.kernel.org/stable/c/5ef87b1b4656d675440ceab32a56e69ad958d3a1 https://git.kernel.org/stable/c/7700a31039cdc6715cb6cce7e7a664ee4e945f67 https://git.kernel.org/stable/c/a626dfca96041842053cf2d1efceb436c4cd8dcf https://git.kernel.org/stable/c/a837deeaa37cc3f0e8c4e5c096787047f272c956 https://git.kernel.org/stable/c/dc711fb137b33c12e6ca22b6a9c9b9f21d49e4de https://git.kernel.org/stable/c/fa0dca89b4fb0909ffda7b9ab6051af33270f95e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-03T08:21:49.526Z

Updated: 2026-09-04T04:58:18.567Z

Reserved: 2026-08-26T14:34:25.789Z

Link: CVE-2026-80732

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-03T13:06:11.900

Modified: 2026-09-04T05:17:13.770

Link: CVE-2026-80732

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-03T13:30:04Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object